Handheld 2.4 GHz Spectrum Analyzer

After visiting some web pages about 2.4 GHz ISM band spectrum analyzers based on the CYWM6935 module, I tried to build my own analyzer, but with some improvements. The references I found on the net used the parallel port or a serial link to a host computer. I want the analyzer to be portable, and easy to transport, so I will use a microcontroller and a graphical LCD.

I had also some old Nokia phones, so maybe I can use phone plastic box and build in LCD to make my own portable analyzer, but... Does it can be done? Let's see:

Microcontroller: The microcontroller would be an ATMega8 running at 3.3 volts because both the the LCD module and the CYWM6935 are 3.3 volts devices. The ATMega8 will do nicely the job even running with low internal clock rates, so I choose to run it at 4 MHz using the internal oscillator.

LCD: The LCD would be the one from the phone, in this case a Nokia 3410. The LCD uses a PCD8544, so it must be easy to work with it. There are many code around to use this kind of LCD controllers

Battery: This phones can use two kind of batteries: Li-ion and Ni-Mh, but both types are equivalent from the equipment's point of view. Useful voltage range is 4.2 down to 3.6 volts. My first idea was to use a voltage regulator to 3.3 volts, but I didn´t find a suitable one, so I choose to put a single 1N4004 diode between the battery and the circuit. The useful range (4.2 town to 3.6 volts) minus the 0.6 volts drop out at the diode will be seen as 3.6 down to 3.0 volts at the circuit supply. The LCD and CYWM6935 module can work from 2.7 up to 3.6 volts, so everything must work safely.

The prototype

I mounted a prototype to test module and microntroller functions when I found my first problem. According to the info on Internet, Nokia's 3410 LCD uses a PCD8544 controller, the same as the Nokia 3310 LCD, so both LCD can be driven with the same firmware. Yes and no. Both LCD use the same PCD8544 instructions set, but screen resolutions are different. Original Nokia 3310 LCD is 84 x 48 pixels, but Nokia's 3410 LCD is 96 x 65 pixels, so LCD routines must be rewritten to use the new resolution.

After rewriting the routines, you must expect a working LCD, isn't it? Not again. The Nokia 3410 LCD have a visible resolution of 96 x 65 pixels, but the real resolution inside the LCD controller is 102 x 72 pixels, so you must to have this in mind while writing your code.

 Left: Nokia 3410 LCD with Nokia 3310 routines.
Right: Nokia 3410 LCD with correct resolution routines

 

The second problem was the CYWM6935 module. Timings and a correct module initialization is very important for optimum performance, so once everything was OK, I saw my first 2.4 GHz spectrum display with my test signal: A wireless camera working on 2468 MHz.

  The prototype showing a wireless camera at 2468 MHz

After many tests, I found the different ways to show the spectrum in the display, one to display fast digital signals (like wifi, bluetooth, etc), one to display analog signals (wireless cameras, wireless phones, etc) and one to show a average use of the whole band. To switch easily between these modes I will need a pair of buttons, and because working with batteries, an on screen voltmeter would be nice. This can be easily accomplished with microcontroller's ADC, so the final schematics for the portable 2.4 GHz spectrum analyzer is finished.

Handheld 2.4 GHz spectrum analyzer schematics

 

Mounting the analyzer

A Nokia 3410 case has a lot of space to mount components, but with one important limitation: You can not go higher that 3.3 millimeter, the height of the original Nokia PCB, so SMD components will help you to accomplish this.

To keep my components under 3.3 millimeter high, I needed to make holes in the PCB to accommodate the PDIP ATMega8 microcontroller and  the two buttons. Once the holes are made, I glued together the PCB with the LCD plastic case, in this way I could solder the tiny LCD contacts to the pads with wire.

The CYWM6935 module is well above the 3.3mm limit, but it can be placed at the phone's antenna place if previously you cut the module to strip off the transmission antenna: It will not be used.

Once every component is in place, I made the connections with thin insulated wire. This is the final result, not beautiful, but fully functional:

The next step was to place the six screws, so the analyzer was finished.

 

The software

The software is written in C using arv-gcc under Windows (WinAVR). LCD routines are based on Fandi Gunawan's Nokia 3310 routines and CYWM6935 routines are based on the code of  Jason Hecker (see at the bottom for details). The program runs continuously and make around six or seven scans (from 2400 up to 2495 MHz) per second, displaying data in almost real time.

There are three display modes implemented:

Fast: Display amplitude data directly from the module with no processing. This mode is suitable for searching analog signals (with carrier).

Slow: Update amplitude data on screen only if current signal is greater than the previous one, if not, displayed signal is decreased by one until it reach zero. This mode is useful to see digital signals, that usually comes in bursts. The fast and slow mode work much like the AGC setting in a communication receiver.

Exposure: In this mode, the signal is updated in the screen only if current value is grater than the previous one. In this way, running this mode for a few seconds or minutes, you can get a nice photo of the spectrum usage around you. The reset button just clears the display to start a new exposure.

 

In practice

The analyzer has become my best travel companion. It's very discrete: everyone think you are playing with a mobile phone!. You can see in a moment what are the used frequencies / channels at your location. One of the most interesting things if to carry it in the pocket in exposure mode and walk sometime in your neighborhood. In this way you can find easily what are the free frequencies or channels. With the time, I learned how to distinguish between different devices:

WI-FI signals: In exposure mode they have a nice rounded shape about 20-22 MHz wide at most.

Wireless FM cameras (and ATV signals): You can see clearly the carrier and the modulation. If the video signal have sound, you can see a pair of sidebands about 6 or 7 MHz from the main carrier.

Bluetooth devices: This devices are difficult to detect, except in exposure mode. They appear as random peaks all over the spectrum up to 2483 MHz.

Microwave ovens: Just full scale noise. I noticed the center frequency drifts with the oven load: If nothing is inside the oven, the center drift up several MHz. Usually they are centered around 2450 having a noise bandwidth of about 60 or more MHz. Of course, they are the main signals at breakfast, lunch and dinner time.

Other devices: There are many other signals in the band unidentified. Some of them are analogic, other one are digital, but usually a few MHz width. I suspect they are low rate devices, like wireless keyboards or such devices. I have also detect some places with strong carriers, most of then around 2440 MHz. I don't know what they are yet.

Out of band signals: The ICM band ends at 2483.5 MHz, but the analyzer scans up to 2495 MHz. I usually use this segment as a noise reference, but sometimes I had found signals in this area. Some of them seems to be spurs from ICM devices, but others are not...

The most used frequency is always the segment 2450 - 2470 MHz,  wifi channel 11. I suppose this is the common default channel in many many wireless routers and access points.

 

Improvements

If you have reached this, you would notice there are two missing things in the analyzer. The first one is an on / off switch. Where can I install a switch without damage the appearance? Originally it was placed at the top of the phone, but now there is located the module, and it is no good idea to place wires near its antenna. But I must admit I didn't miss an on/off switch. The analyzer consumes less than 15 mA, so it can work some days continuously with the typical 900 mAh battery from this phones.

The second missing thing is a build-in battery charger. It would be nice to implement a little Li-ion battery charger, but these kind of batteries must be charged very carefully. If I found an small Li-ion integrated circuit charger, I would try to install it inside, using the original charger jack, and of course, the original phone charger. Meanwhile I charge the batteries outside, in a spare Nokia 3330 I have lying around.

 

Documentation

Source files and makefile for this project can be found here. These datasheets will be also useful to you:

• CYWM6935 datasheet can be found here.
• CYWUSB6935 datasheet can be found here.
• PCD8544 datasheet can be found here.

Also, I have taken ideas and some portions of code from these places:

• DIY 2.4GHz Spectrum Analyser
• LCD Nokia 3310 (PCD8544) Driver in WinAVR(avr-gcc)
• http://1010.co.uk/spectrumtest.c
• scrying:module_spectrum
• Atmel AVR code for using Cypress Wireless USB modules
• Simple C code snippets for CYWM6935 RF module

I wish to thank you all for share your experiences with the rest of us.