I used my four UFO 313 for a couple of years, but now, even the Astra 28.2° East shut down most of its Radio transmissions on QPSK Modulation (aka DVB-S)
Since Kathrein is not providing an update for these modules, I try to convert them to a internet-radio modulator, since the used technology is (as always) superb quality.
Other than the block diagram in the brochure I found the following after opening:
- DAC5686 https://www.ti.com/lit/ds/symlink/dac5686.pdf?ts=1714152266028&ref_url=https%253A%252F%252Fwww.ti.com%252Fproduct%252FDAC5686
- MB86H01 https://www.fujitsu.com/jp/group/fsl/en/documents/about/resources/news/press-releases/2008/20081127e.pdf
(and many more)
It seems that the adio running out of the four MB86H01 is already I²C - so cutting the connection to those decoder chips and feeding own I²C generated by a ESP32, RaspberryWhatever should be possible I hope.
So we could get a Internetradio to High Quality Cable Headend Conversion and use these superb devices for the next 20 years as well!
If someone has some e-waste since that incident, too, leave me a note. I think that does not have to be!
Identifying and extracting I²S (Inter-IC Sound) data from a closed-source DVB-S to FM modulator involves several technical steps. Here's a structured approach:
- Locating the I²S Bus on the PCB I²S is a serial bus for digital audio, with three main signals (sometimes four):
SCK (Serial Clock) – Synchronizes data transmission.
WS (Word Select) – Indicates left/right channel (typically 48 kHz or similar).
SD (Serial Data) – Actual audio data (16/24/32-bit samples).
(Optional) MCLK (Master Clock) – Often 256× or 512× the sample rate (e.g., 12.288 MHz for 48 kHz).
How to Find I²S Traces: Follow the DVB Demodulator Chip:
Look for the DVB-S demodulator IC (e.g., STV090x, Montage, etc.). Check its datasheet for I²S pins.
Trace the pins labeled I2S_OUT, SDATA, BCLK, or similar.
Check Nearby Audio DACs or FM Modulators:
The I²S bus likely connects to an audio DAC or directly to FM modulator ICs (e.g., TEA5767, SAF7741, or RDA5807M).
Physical PCB Inspection:
I²S traces are usually short and run parallel (to avoid clock skew).
Use a multimeter in continuity mode to verify connections between chips.
- Confirming the I²S Bus Oscilloscope or Logic Analyzer:
Probe suspected pins to verify I²S signals:
SCK will pulse at MHz frequencies (e.g., 2-4 MHz for 48 kHz audio).
WS will toggle at the audio sample rate (e.g., 48 kHz).
SD will show random-looking data synchronized to SCK/WS.
Example tools: Saleae Logic Analyzer, Digilent Analog Discovery, or a cheap CY7C68013A-based logic sniffer.
- Extracting I²S Data Once you've identified the bus, you can capture and decode the data:
Option A: Logic Analyzer + Software Decoding Capture: Use a logic analyzer to record SCK, WS, and SD.
Decode:
Use PulseView (with I²S decoder) or Saleae Logic (with custom script).
Configure bit depth (e.g., 16/24-bit), endianness, and WS polarity (left/right channel).
Option B: Microcontroller Interception Use an MCU (e.g., STM32, ESP32) to read I²S directly:
Configure the MCU as an I²S slave.
Store data to an SD card or stream via USB/UART.
Example: ESP32’s I2S library can capture and forward audio.
Option C: FPGA Sniffing (Advanced) For high-speed or multiplexed I²S, an FPGA (e.g., Xilinx Spartan) can capture and buffer data.
- Processing the Extracted Data Raw I²S data is just PCM audio (e.g., 16-bit signed, little-endian).
Convert to WAV using sox or Python:
python import numpy as np raw_data = np.fromfile("i2s_raw.bin", dtype=np.int16) # Adjust for bit depth raw_data.tofile("audio.wav") # Add WAV header manually or use scipy.io.wavfile 5. Challenges & Considerations Closed-Source Hardware: No schematics mean manual tracing.
Multiple FM Modulators: If the I²S bus is shared, it might be time-multiplexed or use TDM (Time-Division Multiplexing). Adjust decoding accordingly.
Clock Synchronization: Ensure your capture device syncs correctly to SCK/WS.
Legal/Ethical: Reverse-engineering may violate warranties or licenses. Proceed carefully.
Tools You’ll Need Hardware:
Oscilloscope / Logic Analyzer
Multimeter (for continuity checks)
MCU/FPGA (optional for interception)
Software:
PulseView, Saleae Logic, or Sigrok
Python (for post-processing)
Phase 1: Reconnaissance & Hypothesis (Multimeter & Visual Inspection) Before powering on, gather clues.
Identify the Key Suspects:
Main ICs: Locate the main processor (large BGA or QFP chip), audio DACs (often 8-16 pin SOP/SSOP), audio ADCs, or dedicated audio codec chips. I²S typically connects between these.
Memory Chips: I²S is sometimes used to stream audio to/from memory buffers.
Digital Audio Interfaces: Look for physical connectors labeled "SPDIF," "TOSLINK," or just "Audio." The traces from these often go to a transceiver chip, which may use I²S to talk to the main processor.
Trace and Group Pins (Multimeter - Continuity Mode):
Find 3-5 pins grouped close together on the main processor and the suspected audio chip(s). Look for pin names if they are visible in tiny print:
BCLK or SCK (Bit Clock)
LRCLK or WS (Word Select/Left-Right Clock)
DATA or SD (Serial Data)
MCLK (Master Clock) - Not always present.
Use your multimeter in continuity/beep mode (power OFF!) to verify connections. One pin on the main chip's DATA should connect directly to a pin on the DAC's DATA. Do the same for BCLK and LRCLK. This grouping of 3 connected trace pairs is your primary suspect.
Check Pin Voltages (Multimeter - DC Voltage):
Power the board. Carefully measure the DC voltage on your suspect pins (relative to ground).
Typical finding: The clock lines (BCLK, LRCLK, MCLK) will often sit at a steady mid-rail voltage (e.g., ~1.65V on a 3.3V system) when idle, because they are driven by push-pull outputs.
The DATA line might be at VCC or GND when idle, depending on its last state.
Phase 2: Signal Analysis & Confirmation (Digital Oscilloscope) This is where you prove your hypothesis. Set your scope to DC coupling.
Initial Setup:
Probe Ground: Use the short ground spring on your probe tip. Long ground leads are useless for high-speed digital signals.
Trigger: Set to Auto or Normal on one of your suspect clock lines.
Voltage Scale: Start at 1V/div or 500mV/div for a 3.3V system.
Time Scale: Start with a relatively slow scale (e.g., 10 µs/div). You're looking for a periodic signal.
Find LRCLK (Word Select) First:
This is the slowest, most distinctive clock. It toggles at the audio sampling frequency (e.g., 44.1 kHz, 48 kHz).
Probe your suspect LRCLK line. Generate audio! Play a constant tone (e.g., 1 kHz sine wave) or continuous music/pink noise through the system.
What to see: You should find a clean, square wave with a 50% duty cycle (or close to it).
Measure the frequency: It should be a standard audio sample rate: 44.1 kHz, 48 kHz, 96 kHz, etc. (e.g., 48 kHz = period of ~20.8 µs). This is a huge clue. A 48.0 kHz square wave on an unknown pin strongly suggests LRCLK.
Find BCLK (Bit Clock) Second:
This is much faster. It's the clock for each individual data bit.
Once you've found LRCLK, zoom in on its edge (switch to 200 ns/div or faster).
Probe your suspect BCLK line. You should see a high-frequency burst of pulses that is active only during the LRCLK period.
Relationship is key: The number of BCLK pulses per LRCLK half-cycle (high or low) equals the number of bits per audio channel per sample. Common multiples are 32 or 64. Count them.
Frequency example: For 48 kHz LRCLK and 64 BCLKs per frame, BCLK frequency = 48 kHz * 64 = 3.072 MHz.
Analyze DATA:
Probe the suspect DATA line. Use the LRCLK as your trigger source (edge trigger, stable display).
The Pattern: You will see that the data line is stable and changes only on the falling (or rising) edge of BCLK. More importantly, the data value is different when LRCLK is high (Left channel) vs. when LRCLK is low (Right channel).
The "Smoking Gun": If you stop the audio, the data line may become constant (all zeros or a repeating pattern). When you resume audio, it becomes a complex, shifting waveform. This confirms it's carrying actual audio data.
Look for MCLK (Master Clock - Optional):
This is a continuous, high-frequency clock (e.g., 256 × LRCLK = 12.288 MHz for 48 kHz). It may not be present on all interfaces.
Phase 3: Putting It All Together (Scope Triggers & Decoding) Use the Scope's Advanced Features:
Multi-Channel View: Connect three probes to your three suspects. Trigger on LRCLK. You will see the perfect timing relationship: DATA changes with BCLK, and LRCLK defines the channel.
Digital Decoding (If Available): Many digital scopes have an I²S decoder. Connect BCLK, LRCLK, and DATA. Set the decoder to I²S format (note: data is often valid on the second BCLK edge after LRCLK transition - you may need to adjust polarity). If you see a stream of hexadecimal numbers changing with audio, you have 100% confirmation.
Signal Characteristics Summary:
I²S is a 3- or 4-wire synchronous serial bus.
LRCLK: Low frequency (~44.1-192 kHz), 50% duty cycle square wave.
BCLK: High frequency (LRCLK freq × 32, 64, etc.), bursts in sync with LRCLK.
DATA: Changes on BCLK edges. Different data in LRCLK high vs. low periods.
Final Checklist:
Found 3-4 traces connecting audio-relevant chips.
LRCLK is a ~48 kHz square wave.
BCLK is a faster burst clock, synchronous with LRCLK.
DATA changes with BCLK and differs per LRCLK state.
(Bonus) Scope decoder shows audio data.
By methodically applying this process, you can positively identify an I²S bus on any PCB, turning an unknown set of traces into a clearly understood audio data path.