• Complete Teardown

    Blaine Murphy01/11/2018 at 02:44 1 comment

    I tried to find a teardown of the KD-C1 before I purchased it. I managed to find a Russian video of a partial teardown, but this video stops short of removing the PCB from the plastic case (for good reason as seen below). I decided to go deep and completely disassemble the radio as far as I could.

    The belt clip and battery cover were easy to remove without tools. Below the battery cover there were 6 Torx screws holding the plastic halves of the radio together. One screw was hiding under the battery compartment label.

    Once the screws were removed the two plastic halves separated easily.

    This is the point where the teardown I found stopped. The radio charges via USB or in a charge cradle that connects to the PCB via metal contacts on the bottom of the plastic case. These metal contacts are soldered directly onto the PCB making removal from the case impossible without desoldering or cutting them.

    I decided to take the risk of melting the case and used a ColdHeat portable soldering iron and solder sucker to detach the tabs. After using the solder sucker I was able to push the tabs through the holes they were installed in. I melted the case just a bit, but it shouldn't be too obvious once the tabs are replaced.

    The antenna and speaker wires were also soldered to the PCB and needed to be desoldered before the board was removed. I wasn't able to completely remove the antenna from the plastic case because it seems to be molded or glued into the plastic. To work around this I tucked the antenna under the board once I desoldered it.

    After the tabs, speaker, and antenna were disconnected the only remaining restraint was a nut hidden below the volume/power knob. I removed the knob by pulling it off the potentiometer. I was able to loosen the nut by wedging a flat head screwdriver in one of the grooves and pushing to cause the nut to spin counter-clockwise

    Once all impeding connections were been broken I (finally) removed the PCB from the case. I used a screwdriver to lift the right side of the board and pulled it out by the lower right corner. This step was a little tricky and took some patience.

    I took some photos of the board once I got it out. I tried to get clear shots of all the ICs and traces in case someone finds them useful.

    Here is a shot of the side of "font" of the PCB that is hidden by the case.

    There are several 8-pin packages on the front of the board. One IC is labelled with the model number of the radio "KD-C1", the other is labelled "HK24C08".

    This one is labelled "M4871".

    There is also what looks to be a custom microcontroller "TA3767P" and a radio transceiver IC "AT1846S" on the back of the board. I had to remove a metal shield to get access to the transceiver IC.

    I didn't come up with much searching for the AT1846S. I found a general description posted by a supplier, but I couldn't find a datasheet. The general description states the IC is portable FM radio transceiver that works in the ranges 134MHz-174MHz, 200MHz-260MHz, and 400MHz-520MHz. At first glance this IC looks similar to the RDA1846 (aside from the "S" suffix) that is in the Baofeng UV-3R radios. The layout of the AT1846S on the PCB is similar to the pinout of the RDA1846 from its datasheet meaning the two might be pin-compatible.

    This has been a promising teardown. I am pleased to find out that the radio's transceiver IC might officially support 1.25m frequencies. Now I just need access to a spectrum analyzer and some radio testing equipment so I can get my hand dirty with modifications.

  • Out-of-Band Programming

    Blaine Murphy01/05/2018 at 02:27 0 comments

    I recently purchased the tiny WLN KD-C1 radio as a Christmas gift for myself. I bought this particular radio because it was dirt cheap (~$20 on Amazon) and because I want to play with lesser-used bands in my area. Many amateurs that I have encountered in northern WV operate on VHF (2m) frequencies for FM simplex because it has better propagation characteristics than UHF (70cm) where there are lots of mountains and trees. Much of the UHF band around here goes unused making it a perfect place to experiment.

    (Yes, the WLN logo is printed backwards)

    here are other models by different companies that all look identical except for the front label. AFAIK these are all the same radio inside, but I am not 100% certain. All of these radios use the same Chirp module for programming and have identical code-plug formats.

    I reprogrammed the radio with local UHF repeaters and FM simplex channels using Chirp. I was able to hit one of the repeaters near me, but got no response from other hams. Curious to see what else I could do with my new toy I set out to see what range of frequencies it can operate on. The radio's label lists the frequency range of 400MHz to 470MHz, but the source for Chirp's retevis_rt22 module enables programming frequencies from 400MHz to 520MHz. To test if the radio would operate on out-of-spec frequencies I modified Chirp's RT22 module on my box to allow any frequency from 100MHz to 1GHz to be programmed.

    The modification of the Chirp module is easy on Arch Linux since Chirp is installed as python source files (.py). First locate the source file for the Retevis RT22. On my computer this is /usr/lib/python2.7/site-packages/chirp/drivers/retevis_rt22.py but will probably be somewhere else depending on how your distribution installs python programs. After locating the file edit the get_features() method of the RT22Radio class by replacing the linerf.valid_bands = [(400000000, 520000000)] with something like rf.valid_bands = [(100000000, 1000000000)]. This modification will allow you to enter any frequency between 100MHz and 1GHz in Chirp, but does not guarantee that the frequency will actually work for receiving or transmitting.

    After modifying the file I created a test codeplug that contained every calling frequency for FM simplex that fit in the expanded test range. I am in the US so this included the following frequencies: 146.520MHz (2m), 223.500MHz (1.25m), 446.000MHz (70cm), and 927.500MHz (33cm). After I programmed the radio I used my RTL-SDR dongle and GQRX to monitor each test frequency as I keyed the radio up.

    (The SDR is attached to the back of the laptop lid with Velcro and is currently sporting a Nagoya NA-771R VHF/UHF antenna)

    The 2m and 33cm frequencies caused no change on my waterfall, but the 1.25m and 70cm frequencies caused a strong signal to appear. I have not personally tested the radio's ability to receive on the 1.25m band, but after some searching I found a page where VE3PZR has programmed the radio to 1.25m and had luck receiving some stronger signals. VE3PZR's page linked to this RadioReference.com thread where he mentions he believes the radio is putting out spurious emissions when transmitting on 1.25m. I would like to test the performance of the radio using a proper spectrum analyzer to see how bad these emissions are.

    Using the vanilla radio with out-of-band frequencies is a very bad idea because it may interfere with other parts of the spectrum. Operating out-of-band may also result in poor transmit power, unexpected behavior, and even damage to the transmitter circuitry. I would very much like to take a closer look at the hardware in this radio; it may be possible to make the radio work well on 1.25m.