Drivers with a lead foot more often than not have Waze open on their phone so they can see if other drivers have spotted cops up ahead. But avoiding a speeding ticket used to involve a lot more hardware than software. Back before the smartphone revolution, that same driver would have had a radar detector on their dashboard. That’s not to say the gadgets are completely unused today, but between their relatively high cost (one of the top rated models on Amazon as of this writing costs over $300) and the inevitable false positives from so many vehicles on the road having their own radar and LIDAR systems, they’ve certainly become a less common sight over the years
The subject of today’s teardown is a perfect example of “Peak Radar Detector”. Manufactured back in 2007, the Cobra XRS 9740 would have been a fairly mid-range entry offering the sort of features that would have been desirable at the time. Over a decade ago, having an alphanumeric display, voice alerts, and a digital compass were all things worth shouting about on the box the thing was sold in. Though looking like some kind of Cardassian warship was apparently just an added bonus.
As the name implies these devices are primarily for detecting radar activity, but by this point they’d also been expanded to pick up infrared lasers and the strobe beacons on emergency vehicles. But false positives were always a problem, so the device allows the user to select which signals it should be on the lookout for. If you were getting some kind of interference that convinced the detector it was being bombarded with IR lasers, you could just turn that function off without having to pull the plug entirely.
But it’s important to remember that this device was built back when people were still unironically carrying around flip phones. Detecting laser and multi-band radars might sound like something pulled from the spec sheet of a stealth fighter jet, but this is still a piece of consumer electronics from more than a decade in the past. So let’s crack it open and take a look at what goes on inside a radar detector that’s only a few years away from being old enough to get its own driver’s license.
The Horn of Plenty
With the Cobra’s case open the largest and most obvious component is, as you might have guessed, the radar detector itself. Or more accurately, the metallic waveguide of the detector. This structure, often called the “horn” for fairly obvious reasons, funnels the radar waves down into the detector circuitry. You’ll note here that there’s only a single wave guide, and it faces forward; this unit would have limited ability to detect radar from any other direction than directly ahead, which was typical until they started adding more wave guides on higher end models later on.
Another interesting note are the set screws directly behind the horn. These allow adjusting the resonant frequency of the detector cavity, and once they were set to the appropriate lengths at the factory, an adhesive was applied to the top to make sure they didn’t rotate from vibration. Upon opening the wave guide itself, you can see that the length of these screws actually varies wildly. Combined with the fact that there are open holes for additional unused screws to be installed in, it would seem that there was considerable variation between detectors that needed to be manually addressed during the QA process.
Behind the set screws and located 90 degrees from the face of the horn itself is the superheterodyne receiver. According to the manual it can detect frequencies from the X band at 10.5 GHz all the way up to Ka band at 34.7 GHz. Owing to the amount of high frequency RF Dark Arts that are happening on this 20 mm long board, the construction techniques and even the substrate used on this PCB are markedly different from the rest of the device.
Seeing the Light
Located under a shield slightly smaller than the radar waveguide housing is the infrared laser detector. This component is actually a separate module, complete with a header that allows it to be easily swapped out once the screws holding it down are removed. It could be that laser detection technology was considered such a moving target at the time that Cobra wanted to keep it as a separate module, allowing them to potentially improve that particular capability down the line without having to redesign the entire board. It’s also possible that a cheaper version of the Cobra XRS 9740 was available that didn’t have the laser capability. In either event, it would be interesting to take a peek inside of other detectors from the era to see if this was a common trait.
The main components on this module are the PIC12F629 microcontroller on the far left and BA10358 operational amplifier to the right of it. Unfortunately the dual IR detectors, one mounted on the front of the board to align with the radar horn and the other mounted flat on its back and facing a lens assembly on the top of the device, don’t have any identifying markings. That said, the two-pin sensors look suspiciously like the sort of IR detectors you’d see in an old mouse.
Valuable Treasure
The display aficionados in the audience have been waiting patiently, and now it’s their turn. Along the back edge of the Cobra XRS 9740, diffused with a piece of smoked black plastic, is an absolutely gorgeous eight character alphanumeric LED display in that perfect shade of Matrix green.
It turns out this is a HCMS-2973, a well documented display that’s even supported by a couple of Arduino libraries. These are normally pretty pricey, selling for $10 to $20 used and currently listed for $36 a pop on Digi-Key. That’s more than these old radar detectors often go for on eBay (to say nothing of flea market finds), so if you don’t mind spending some quality time with the desoldering wick, you could potentially turn a profit just by snapping up old detectors and reselling their screens.
In this case the HCMS-2973 lives on a small daughter-board that allows it to be mounted vertically. The fine people at Cobra even went through the trouble of sorting out the display’s somewhat unusual pin arrangement and broke out the five lines you need to actually drive it to solder pads along the edge of the board. Very thoughtful of them.
Potential for Greatness
On the flip side of the Cobra’s main PCB, we find a relatively familiar face: an ATmega644 microcontroller. Next to the 44-pin TQFP packaged chip are helpfully labeled JTAG points and what appears to be an unpopulated programming header.
Seeing not one but two recognizable microcontrollers is certainly refreshing considering how many miserable epoxy blobs we run into these days. Admittedly there aren’t a lot of folks chomping at the bit to hack a radar detector from the early 2000s, but assuming there was sufficient interest, let’s theorize a bit here.
Following the traces, the PIC in the laser module is connected directly to the I/O pins on the ATmega. A logic analyzer placed between them should reveal in relatively short order whatever whispered secrets the pair of microcontrollers are sharing with each other. That’s half of the device’s functionality right there. Getting the display working wouldn’t be a problem either, the HCMS-2973 is a standard component, and it to can be traced directly back to the pins on the ATmega.
So what stands between the Cobra XRS 9740 and an open source replacement firmware for freedom-loving speedsters? Well, the big chip labeled “MCS LOGIC COBRA” might have something to say about it.
Any effort to create a custom firmware for the device would have to involve reverse engineering whatever this chip is doing. If Cobra went through the trouble of getting the chips manufactured, especially in a device that otherwise doesn’t seem to have a problem using off-the-shelf components, it’s probably used for some radar groking magic they wanted to keep close to the vest.
Of course, this is a bit of an oversimplification. There’s a handful of other unidentified chips lurking around the PCB that would need to be dealt with as well. Getting the classic “Hello World” running on the display might only be an afternoon’s worth of tinkering, but the difficulty really ramps up from there. If anyone feels like challenging themselves, it seems like there’s enough pieces here to conduct a fascinating open source experiment. Ultimately it might just boil down to how far a free software fanatic is willing to go keep the Smokey off his tail.
“they wanted to keep close to the vest.” Aha, yet more evidence that hackaday articles are generated by a neural net trained on twitter, or that it’s written by Space Aliens.
Or perhaps it’s the case that the author actually possess a full, rich English vocabulary, the phrase occurs often in both contemporary and classical literature.
The modern era of UFO sightings is said to have started in WWII with foo fighters, check out the graph here…
http://www.matthewdicks.com/matthewdicksblog/2016/4/20/close-to-the-chest-or-close-to-the-vest-the-answer-annoys-the-hell-out-of-me
Coincidence? I think not!
If there’s any turn of phrase to take issue with here, I’d say it’s the use of chomping vs champing at the bit.
Indeed, that is also worrying, see graph further down page here… https://english.stackexchange.com/questions/187702/which-of-chafing-at-the-bit-or-chomping-at-the-bit-is-more-accepted-proper
Notice how its early peaks also correlate with UFO sighing waves, space aliens confirmed! ;-)
“Sighting” i think?
No, it’s using “groking’ instead of ‘grokking’. Even your spell checker flags ‘groking’.
which, of course, is from “Stranger in a Strange Land” by Robert Heinlein, about a human that grew up among Martians and returned to Earth.
The cobra-06 chip is an audio playback IC I think. It is used for the voice alerts.
I have bought my cobra some 5 years back and saved me a lot of money so if their are maybe a better one on the market I will be interested to buy the upgrade one
Neat to read. I’ve been wondering if anyone has hacked a more modern radar detector into a receiver, detector or maybe even signal analyzer. Wondering what the noise floor or sensitivity is one these?
I asked a few days back too if anyone has figured out the uBlox, or other GPS modules RF Block and Digital Block, requirements to be able to hack one of those (especially new generations) into a detector or maybe lower baud rate receiver. The sensitivity is really low… like ~140 to 170dBm. Figure shielding and mixing the detector input to the GPS module antenna input is easy… though getting the desired optimal output will be a little more challenging unless stock or some modified com code for the stock code format.
Awesome teardown, I have a Whistler XTR 558 on my list to play with as a detector and maybe a receiver in the GHz range.
This detector front-end is very simple. It is just a single stage amplifier and then a diode detector. Most likely you can just apply voltage to the supply pin and measure the envelope of all in-band signals on the other pin. Noise floor will not be spectacular due to the very large bandwidth, but the radar signal is strong enough so it doesn’t matter.
Some more sensitive radar detectors have a mixing stage, then you need to get the LO up and running, usually at 12GHz. They can be detected using a radar detector detector if there is no BPF in the antenna circuit.
In any case, if you want a cheap microwave front-end with down-converter, look into a satellite LNB.
The GPS sensitivity is only so high because the signal contains only 50bps worth of information. Most of the sensitivity is in the amplifier integrated in the antenna. This one typically has a noise figure of 0.5-2dB, you can attach it to an SDR, it just works (provided 3-5V bias is present). Some older uBlox solutions have a separate RF chip, with analog I/Q outputs, you could tap them.
You can buy GPS frontends cheaply, for example: MAX2769. Note that their integrated ADCs typically have very few bits, as in theory even just a one bit ADC is enough for DSSS decoding with sufficient oversampling.
This is exactly right. We are actually using a Maxim IC to do our I/Q demod after a single conversion stage.
On the topic of using a radar detector as a “spectrum analyzer,” one thing we did with the FPGA and DSP in ours is make it compatible with RfNoc. We have used GnuRadio extensively during development, so someone will literally be able to take our radar detector and run GR-Fosphor on it inside the FPGA if they want to – with the benefits of a beautiful 60msps 14 bit IQ ADC.
“That’s more than these old radar detectors often go for on eBay (to say nothing of flea market finds), so if you don’t mind spending some quality time with the desoldering wick, you could potentially turn a profit just by snapping up old detectors and reselling their screens.”
And do what with the rest? This is how landfills get filled up.
what was your plan for them before you discovered that the screens were useful?
I seem to recall articles from decades back about using radar detectors as microwave receivers. You don’t need the screen for that. These are superhet receivers, not the early radar detectors with a diode set ctor at the antenna and then an audio amplifier. The oscillator might be used for transmitting.
But, if radar detectors are so cheap, it seems likely there’s not much interest in using them as radar detectors. So if nobody buys them, even for the screen, they will get tossed.
One thibg about ewaste is that people just toss it, casing and all. If I drag home a computer, even if I toss most of the innards, the case will go to.metal recycling. Same with any electronics I bring home, unless I reuse the case for a project.
On a similar note, some clown took me to task a while back for re-using one-side printed copies for some random scribbles and draft printing. (Not from a shred pile or anything like that for the quibblers) Said I should put them in recycling where they belong for the Good Of The Planet, I said “I AM recycling them.” and I don’t know if he suddenly got it, or his brain jammed, just stared at me blankly for a few seconds and went away.
Technically you are not recycling the paper, but reuse it. Which is of course better.
Perhaps the brain of the guy suddenly UNjammed. :-) (got it)
I vaguely remember seeing ads that you could send in your old Cobra for an upgrade sometimes when there were new features or new radars deployed. But I don’t now if that was done with a complete hardware swap, a chip swap or merely a firmware flash.
If you are interested in hacking radar detectors, you may be interested in the Radenso Theia that my company is producing:
Open source
Quad Core 1.5ghz ARM processor
1GB RAM
8GB flash storage
Spartan 7 FPGA
14 bit 60MSPS I/Q ADC
USB C
Modular horn and RF front end with over $1mm of r&d
ipex connector to allow others to inject whatever signals they want into the digitizer board
Machine Learning with edge inferencing to eliminate false alerts.
To my knowledge, it is the first open source detector ever produced. We are designing it from the ground up to be a hackable SDR platform which is fairly ambitious for a company like us that already is one of the “big four” in the radar detector space.
there is next to no data about the RF part, which is the most important in a product like this…
Insanely low phase noise, filter passband allows around 3.5ghz of bandwidth swept. Macom LNAs used on front and rear horns, separate signal path diplexed out for X and KA/K band. TI LMX2592 synthesizer used (same one used in $15k SDRs by NI) which means we can look at all 3.5ghz of bandwidth in a couple of MS without resorting to things like chirp compression. Instantaneous analysis bandwidth is 61.44mhz at 61.44MSPS and if we see a CW signal we want a closer look at, we can go back and critically sample it in a 250khz window for insane SNR.
It’s the only receiver in the world that can identify the radar gun being shot by name, we demoed it in our booth at the SEMA show. It’s not a radar detector, it’s a SDR electronic warfare platform that you can put in your car.
Also, because of our hardware we don’t have to do a traditional triple conversion superhet. We are doing a single conversion to a high IF which we use a monolithic IC to do an I/Q demod on. There is literally nothing else like this out there, it’s so much fun to work on.
Is it immune to being detected by RADAR detector detectors?
Yes, and not only that we can actually detect the LO leakage from them as well. Here was a video we did when we dissected a few radar detector detectors and tested them against our prototype https://www.youtube.com/watch?v=jIYRt_qX5k0
Where can I buy one of these said open source radar detector ?
Our current products are based on older technology, so you can’t buy it yet. But it’s in production currently so not too much longer. We are being pretty open about our development process as well so you can follow along on our YouTube channel. Feedback from people who want hack it really help us think of other use cases – for example, putting an ipex connector on.
“$1mm of r&d”
How many mm of R&D is that?
1, In hex. If you want that in decimal, it’s 1.
I also did not get the meaning of this statement. Some special connector with 1mm pitch? Lioke 2,92mm precision connectors or 3,5mm (SMA) standard?
Some people are also extremly slopy with units and SI prefixes: Why would I need an oversampling factor of 10^9: bandwidth is 61.44mhz at 61.44MSPS? Millihertz vs. Megasamples/s
The best way is to use camera real time detection scanner. Several cameras that would work together to alert you when to slow down. What’s your take on this?
Here you can find the schematics and teardown of the Beltronics Euro 550 radar detector:
http://uglyduck.vajn.icu/ep/archive/2010/09/Reverse_engineering_the_radar_detector_Beltronics_Euro_550.html
Might be fun to see if it’s got any sensitivity at 5Ghz for passive mapping off 5Ghz wifi. Just the horn gubbins and possible low pass filtering, glommed on your own smarts.
I had always wondered if it was possible to open up a radar detector, and separate all the sensors in order to mount them remotely throughout the vehicle; behind the front grille, in with a tail light, etc, to hide the thing while in states that ban radar detectors. Never knew they had that big metal waveguide.
I believe there were trucker models where that was possible, well designed in.
The rules they use to ban them some places is not acting on information received on restricted frequencies. So not illegal to have, illegal to use. i.e. they have to prove you slowed down when you detected radar. Other places have a straight device ban though.
Autonomous vehicles are going to be fun though.
So much to hide.
Belltronics STiR plus did this. I believe it was later replaced by a very similar unit branded by Escort.
What I want to know is what was the deal with the clear plastic rods or prisms poking out the front of some old RADAR detectors? Some examples shown here http://www.radardetectormuseum.com/ Also note the waveguides tipped over at an angle on some.
on my old detector the prisim was for IR collection 360′ (thats what the manual said) and in fect we would cover them with tape so the traffic light sensors would not trigger them as at the time only radar was available to our traffic enforcers, now we have laser and theres a great video on laser jamming from VinWiki , to lazy to poast the url but worth the watch when he exsplains how it’s jammed using only a basic 950nm(*sic) chepo laser and arduino.
I could not find the vinwiki but found his defcon talk, https://www.youtube.com/watch?v=vQtLms02PFM
I wonder how difficult it would be to make a device that sends some kind of signal to set off radar/lidar detectors while being legal for anyone to use without a license. If only radar detectors are still in common use (are they?), such a gadget would really come in handy to slow down speeding.
I recall somebody with a bucket full of the old Ma/Com Gunnplexers used in door openers, with 9V battery clips soldered on, at the Dayton Hamvention. He had a sign on the bucket, “BRAKE LIGHT TESTERS.” Those Gunnplexers operate at about 10.5 GHz in an ISM band. I have no personal experience, but I have heard that indeed they can confirm that brake lights work. I suspect that is correct because a friend of mine had a 1990s era radar detector in his Toyota and it went nuts every time we drove past the grocery store.
It should be noted that even though the output power of those Gunnplexers is pretty low, that FCC rules part 15 still requires unlicensed devices not cause harmful interference to other devices and if so operation is to be ceased. It would not be legal to use Gunnplexers as brake light testers. There is the possibility a spooked driver might cause a crash, so it seems like a bad idea anyway.
There was a time when those surplus gunnplexers were used to create mmunucate, so with a ham license they were legal.
If I remember properly, there were schemes to modulate the incoming radar signal, so when it bounced back to the radar gun, there was an audio tone that gave a false reading. I forget detaiks, simething about doppler.
For such devices I have the same appreciation as for cellphone jammers or GPS jammers: NONE. And it should be inserted into the users digestive tract, unimportant from which side. We can also compare this with (on purpose, just for “fun”) calling false alarms to fire department or police.
But if the promises of Jonathen Dandrow about the capabilities of his newest development hold true, then we do not have to fear such malicous transmitters.
A friend of mine in the past was the chief mechanic for a fleet of trucks. The police would pull over these trucks to “detect” RADAR detectors by demanding engine off, key out, then back in to the “operate” position, and listen for the “beep” emitted by the detector on power up – usually mounted behind the radiator grille.
He solved this problem by wiring an additional fuse inline with the power supply for the truck’s detector, and a separate switch to deliberately short the circuit and blow the fuse. Driver sees police ahead waving trucks over, he flicks the “blow” switch (one of many switches and buttons on a truck’s dashboard), and the detector won’t power up when the ignition switch is “on”. Driver would pull over some kms up the road and replace said fuse.
Nice idea to blow the fuse instead of just an interrupter switch, which could be found theoretically by a policemen.
But isn’t it a design flaw to have a beeper on an outside mounted device? Wasn’t this beeper easily removable?