# Mobile Compute Cluster Hardware Reference

> **Research context**: Physical teardown of stripped-phone compute rack as shown in widely circulated click-farm footage (e.g., "Science girl — Dead Internet Theory is no longer just a theory"). This document unpacks the hardware architecture for legitimate applications: mobile QA automation, embedded security research, and large-scale IoT device management.

---

## 1. Overview of the Architecture

The rack shown is a scaled-down **blade-server analogue** built around consumer smartphone PCBs. Instead of standard server blades, stripped phone motherboards slide into card-edge slots with shared power and data backplanes. A control PC running a single-pane management UI orchestrates all nodes over USB or wireless ADB.

```
Control PC (Windows/Linux)
   │ USB / Ethernet
   ▼
USB Hub Backplane ───────┬──────┬──────┬── ...
                         │      │      │
                         ▼      ▼      ▼
                      [PCB1] [PCB2] [PCB3] ...
                      ┌────┐ ┌────┐ ┌────┐
                      │SoC │ │SoC │ │SoC │
                      │+RAM│ │+RAM│ │+RAM│
                      │+EMC│ │+EMC│ │+EMC│
                      │+WiFi/Cellular modem (SIM socket visible)
                      └────┘ └────┘ └────┘
                      Fan rail (common ventilation)
```

---

## 2. Chassis — Detailed Specifications

### 2.1 Frame Material & Construction

| Parameter | Specification | Notes |
|-----------|---------------|-------|
| **Primary material** | 6061-T6 aluminum extrusion (20×20 mm or 30×30 mm profile) or 1.5 mm cold-rolled steel (SGCC) | Aluminum preferred for thermal conductivity; steel for cost |
| **Surface finish** | Anodized (Type II, natural or black) for aluminum; powder-coated (RAL 9005 matte black) for steel | Prevents galvanic corrosion with PCB ground planes |
| **Typical outer dimensions** | 400–600 mm (W) × 250–350 mm (D) × 180–250 mm (H) | No industry standard; sized to donor PCB length + fan duct depth |
| **Frame rigidity** | Deflection < 1 mm under 5 kg cantilever load | Critical if transporting loaded rack |
| **Weight (empty)** | 1.2–3.5 kg depending on material and size | Steel chassis ≈ 2.5× heavier than aluminum equivalent |
| **Mounting standard** | Optional 19" rack ears (482.6 mm OAL) with M6 cage nuts | Only needed if integrating into a server cabinet; desktop units omit this |

### 2.2 PCB Slot / Rail System

| Parameter | Specification |
|-----------|---------------|
| **Card guide material** | Glass-filled nylon (PA66-GF30) or phosphate-coated steel (0.8 mm) |
| **PCB thickness accommodated** | 0.8 mm, 1.0 mm, 1.2 mm, 1.6 mm (FR-4 standard) |
| **Slot pitch (center-to-center)** | 12 mm minimum for boards with shield-can height ≤ 3 mm; 15 mm typical; 18 mm if discrete heatsinks added |
| **Insertion depth** | 120–160 mm (matches typical smartphone PCB length) |
| **Retention method** | Spring-loaded Delrin latch (McMaster 9418K11 style) or M3 nylon thumb screw through chassis tab |
| **PCB edge tolerance** | ±0.5 mm lateral play; 2° angular misalignment acceptable without stressing BGA packages |

### 2.3 Thermal Design Calculations

**Heat load estimation per node:**
- Idle (screen off, WiFi connected): 1.5–2.5 W
- Moderate load (CPU + GPU at 30%): 4–6 W
- Peak (antenna TX burst + CPU): 8–12 W
- 20-node rack at moderate load: **80–120 W total**

**Required airflow:**
- Target internal ambient: ≤ 45°C (most phone SoCs throttle at 65–85°C junction; 20°C margin desired)
- Assuming ΔT = 15°C between inlet and exhaust:
  - CFM = (1.8 × P_watts) / ΔT = (1.8 × 120) / 15 ≈ **14.4 CFM minimum**
- A single 80 mm fan at 2000 RPM provides ~25–30 CFM; 120 mm at 1500 RPM provides ~50–60 CFM. One fan is adequate for 20 boards with moderate pitch.

**Fan specification:**
| Spec | Value |
|------|-------|
| Size | 80 mm × 80 mm × 25 mm or 120 mm × 120 mm × 25 mm |
| Bearing | Dual ball bearing (50,000 hr MTBF) or fluid dynamic bearing (quiet) |
| Connector | 3-pin (PWM not needed at fixed speed) or 4-pin with 50% PWM for noise control |
| Noise target | < 35 dBA for lab environment |
| Static pressure | ≥ 1.2 mm H₂O (needed if perforated steel exhaust creates backpressure) |

**Heatsink additions (if overclocking or stress-testing):**
- 10 mm × 10 mm × 5 mm aluminum fin on EMI shield (thermal adhesive: 3.5 W/mK)
- Thermal pad between shield and fin: 1.0 mm thickness, 6 W/mK conductivity (Fujipoly / Sarcon PG25A)

### 2.4 Ventilation & EMI

- **Intake**: 3 mm hex perforation pattern (55% open area) or mesh filter (50 PPI polyurethane foam to catch dust)
- **Exhaust**: Same perforation; arranged for linear cross-flow, not short-circuit paths.
- **Faraday variant**: If running live cellular modems in a lab where adjacent gear is sensitive, line the interior with conductive fabric tape (e.g., 3M 1181 copper foil, 0.05 mm) and add RF gaskets on the lid. Provide bulkhead SMA or RP-SMA connectors to route antenna cables outside.

---

## 3. Power System — Detailed Specifications

### 3.1 Central PSU Selection

| Scenario | Recommended PSU | Output | Cost (approx.) |
|----------|-----------------|--------|----------------|
| 10-board lab | Mean Well LRS-150-5 | 5 V / 26 A / 130 W | ~$18 |
| 20-board lab | Mean Well LRS-350-5 | 5 V / 60 A / 300 W | ~$25 |
| 40-board lab | Mean Well SE-450-5 | 5 V / 75 A / 375 W | ~$40 |
| 60+ board farm | Two LRS-350-5 in parallel with diode-OR, or a single 24 V industrial PSU + local 5 V buck converters per board | Depends | ~$60–100 |

**PSU electrical requirements:**
- **Input**: 90–264 VAC universal (LRS series); 47–63 Hz
- **Hold-up time**: ≥ 16 ms at full load
- **Efficiency**: ≥ 85% at 50% load (80 Plus Bronze territory)
- **Ripple & noise**: ≤ 120 mVpp (typical). Phone PMICs tolerate up to ~200 mVpp on VBUS, but clean power reduces random reboots.
- **Protections**: OVP (110–135% rated), OCP (110–150%), OTP, short-circuit (hiccup mode)
- **Operating temp**: -20°C to +70°C; derate 3% per °C above 50°C

### 3.2 Power Distribution — Busbar vs. Backplane

**Option A: Busbar + Pigtails (DIY, flexible)**
- **Busbar**: Copper C11000 bar, 3 mm × 10 mm cross-section. At 60 A, current density ≈ 2 A/mm² (conservative).
- **Pigtails**: 20 AWG stranded copper with USB-A male on PSU side, USB micro-B / Type-C / stripped wires on board side.
- **Length**: Keep ≤ 300 mm to minimize IR drop. For 20 AWG at 2 A, voltage drop ≈ 0.1 V over 300 mm — acceptable for USB VBUS (4.75–5.25 V spec).
- **Fusing (optional but recommended)**: 3 A radial leaded polyfuse (Raychem / Littlefuse RXEF030) per board, or PTC resettable fuse (SMD 1206, 2 A hold).

**Option B: Custom PCB Backplane (clean, scalable)**
- **Layers**: 2-layer, 2 oz copper on both sides (power planes on top/bottom).
- **Trace width**: 5 mm per 3 A with 2 oz copper (IPC-2221 external trace).
- **Connector**: 2.54 mm header or pogo-pin block per slot. Pogo pins (CNC Tech / Preci-Dip) allow hot-swapping but wear out after ~10k cycles.
- **Cost**: ~$30–60 for a 150 × 200 mm 2-layer PCB at JLCPCB, depending on quantity.

### 3.3 Per-Board Power Conditioning

Some donor boards are picky about input:

| Issue | Symptom | Fix |
|-------|---------|-----|
| PMIC won't enable without battery thermistor | Board powers on for 2 sec, then shuts down | Solder 10 kΩ NTC thermistor or 10 kΩ resistor + 100 nF cap between NTC pin and GND |
| PMIC expects 3.8–4.2 V (not 5 V) | Overvoltage protection trips, no boot | LM2596 buck module per board: 5 V → 3.9 V, 2 A. Or use a dedicated Li-ion emulator board (B+ and B- pads at cell voltage) |
| Inrush current on plug-in | USB host resets due to 100 µF+ bulk cap charging | Add 10 Ω series resistor for 100 ms, then bypass with low-Rds MOSFET (soft-start circuit) |

### 3.4 Battery Connector Bypass — Common Pinouts

Smartphone battery connectors vary by OEM but share common patterns. When substituting a DC source for the battery, map these pins:

| Pin Name | Typical Color | Function | Required Action |
|----------|---------------|----------|-----------------|
| B+ (VBAT) | Red | Battery positive (3.7–4.35 V) | Connect to PMIC B+ via buck regulator or direct 5 V if PMIC tolerant |
| B− (GND) | Black | Battery negative | Connect to system GND |
| NTC / THERM | White/Yellow | 10 kΩ NTC to GND at 25°C | Fake with 10 kΩ resistor or real thermistor |
| ID / BSI | Brown/Green | Battery identification resistor (varies by OEM) | Match value from original battery (often 68 kΩ, 82 kΩ, or 100 kΩ to GND) |
| SDA / SCL | Blue/Orange | Gas gauge I²C (Samsung, some LG) | Bit-bang or use LTC2941 emulator; many boards boot without it but report 0% battery |

**Critical**: Always verify your donor board's specific battery connector pinout with a teardown guide (iFixit / Witrigs) before applying power. Reversing B+ and NTC can destroy the PMIC.

---

## 4. Data & Networking — Detailed Specifications

### 4.1 USB Topology & Hub Controller ICs

**USB 2.0 High-Speed (480 Mbps) is the practical ceiling** for most Android handsets in debug mode. ADB and MTP top out well below that, so USB 3.0 is only useful for faster log pulls or file pushes.

| Hub IC | Ports | Speed | Notes |
|--------|-------|-------|-------|
| Genesys Logic GL852G | 4 | USB 2.0 | Cheap, ubiquitous, but MTT (Multi-TT) support is firmware-dependent |
| VIA Labs VL817 | 4 / 7 | USB 3.2 Gen 1 | Common in Anker/Sabrent hubs; good signal integrity; supports individual port power control on premium variants |
| Terminus FE1.1s | 4 | USB 2.0 | Ultra-cheap ($0.30 IC); used in no-name hubs; single TT can bottleneck multiple ADB sessions |
| SMSC / Microchip USB2517 | 7 | USB 2.0 | Strapping options for multi-TT, battery charging, and port status LEDs |
| Acroname USBHub3+ | 4 | USB 3.0 | **Per-port power control & monitoring via Python API**; research-lab standard |
| Acroname USBHub3c | 8 | USB 3.1 | Same, with 2.4 A per-port power budget and overcurrent sensing |

**Power budget math:**
- USB 2.0 spec allows 500 mA per port.
- USB 3.0 allows 900 mA.
- Many active hubs share a single 2.5 A upstream input across all ports. A 20-board rig needs at least 10 A on the hub upstream if running from VBUS; in practice it's better to power boards from the dedicated PSU and only use USB data lines (cut or desolder VBUS from the USB cable, or use a "data-only" USB cable).

**Signal integrity:**
- **Max cable length**: 5 m for USB 2.0 (use active extension if > 3 m).
- **Daisy-chain limit**: USB 2.0 allows max 5 hubs in series (127 devices total); USB 3.x allows 6 tiers.
- For a 20-node rack: one 4-port root hub → five 4-port tier-2 hubs is valid but fragile. Better: one 7-port hub → three 7-port hubs (all tier-2), staying within the 5-hub-depth rule.

### 4.2 USB Wiring Diagram (Power Separated)

This is the recommended topology to avoid overloading hub power supplies:

```
Control PC USB Host Controller
      │ (USB data cable, D+/D− only, VBUS NOT connected)
      ▼
Root USB Hub (self-powered, 5 V from main PSU)
      │ D+/D−
      ├──┬──┬──┬── ... (to each node)
      │  │  │
     [PCB1] [PCB2] ...
      ▲      ▲
      │      │
   VBUS 5 V from main PSU busbar (separate wiring)
```

To make a data-only cable: Cut the red (VBUS) wire inside a standard USB cable, or use a commercially available "USB data blocker" (PortaPow style) on each port. The D+ and D− lines remain intact; the shield (GND) is shared.

### 4.3 ADB over WiFi — Network Architecture

If you prefer wireless to reduce USB cable count:

1. **Initial pairing**: Each board must be connected via USB once to enable TCP/IP mode:
   ```bash
   adb tcpip 5555
   adb connect 192.168.x.x:5555
   ```
2. **Persistent config**: Add `persist.adb.tcp.port=5555` to `/system/build.prop` (requires root or a userdebug build).
3. **Network isolation**: Put the WiFi AP and all nodes on a dedicated VLAN or physically isolated router. Do not mix research devices with your production LAN — unpatched Android handsets are attack surfaces.
4. **Bandwidth**: ADB over 802.11n (150 Mbps real) tops out at ~5–8 MB/s for file transfers. Fine for logcat; painful for pulling 2 GB crash dumps.

### 4.4 Cellular / SIM Aggregation

**Multi-port modem pool typical architecture:**

| Spec | Detail |
|------|--------|
| **Baseband modules** | Quectel EC25 / EC21 (LTE Cat-4), SIMCom A7600E (LTE Cat-1), Fibocom L610 (NB-IoT + LTE) |
| **SIM slot type** | Standard Mini-SIM (2FF) or Micro-SIM (3FF); some modem pools use 1.8 V / 3.0 V dual-voltage SIM sockets |
| **SIM switching** | Hardware: physical SIM card reader array with per-modem relay matrix. Software: GSM 11.11 SIM-ME interface; some pools support "SIM rotation" (one SIM shared across multiple modems over time) |
| **Host interface** | USB 2.0 virtual COM ports ( Qualcomm DM / NMEA / AT port multiplexing) or Ethernet (with onboard Linux + PPP/NDIS bridging) |
| **AT commands** | 3GPP TS 27.007 standard: `AT+CSQ` (signal), `AT+CREG?` (registration), `AT+CGACT` (PDP context) |
| **Power** | 12 V / 3 A barrel jack (36 W) or PoE 802.3at |
| **Operating temp** | 0°C to +50°C commercial; -40°C to +85°C industrial (conformal coating, extended-temp baseband) |

**Carrier aggregation note**: Unlike consumer smartphones, low-cost modem pools typically do **not** support true LTE-Advanced CA (carrier aggregation). Each modem is independent, bonded at the transport layer (MLVPN / multipath TCP), not at the radio layer.

---

## 5. Control PC Workstation — Detailed Specifications

### 5.1 Minimum Specification (10–15 nodes)

| Component | Minimum | Notes |
|-----------|---------|-------|
| CPU | Intel i5-10400 or AMD Ryzen 5 3600 | ADB is single-threaded per device; you need cores for parallel logcat parsers |
| RAM | 16 GB DDR4-3200 | Each scrcpy instance ≈ 100–300 MB; 15 instances ≈ 2–4.5 GB + OS overhead |
| Storage | 500 GB NVMe (PCIe 3.0) | Log files and APK builds add up fast |
| GPU | Integrated (UHD 630 / Vega 8) | Sufficient for 2D screen mirroring only |
| USB host controller | Intel PCH native USB 3.1 Gen 1 (Z490/B550 chipset) | Avoid budget hubs on front-panel headers; use rear motherboard ports |
| Network | Gigabit Ethernet + WiFi 6 AP for ADB-over-WiFi | VLAN capable if isolating lab subnet |
| Monitor | 27" 1440p minimum for comfortable grid; 32" 4K preferred for 20+ tiles | AOC 27B2H / Dell U2720Q class |

### 5.2 Recommended Specification (30–50 nodes)

| Component | Recommended | Notes |
|-----------|-------------|-------|
| CPU | Intel i7-13700K or AMD Ryzen 9 5900X | Hyper-threading exploited by parallel ADB threads |
| RAM | 32–64 GB DDR4-3600 | Running Android emulators alongside real devices balloons memory |
| Storage | 1 TB NVMe (PCIe 4.0) + 4 TB SATA SSD archive | Sequential write throughput for simultaneous logcat dumps |
| GPU | NVIDIA GTX 1660 Super or better | If using OBS or GPU-accelerated screen recording for device sessions |
| USB | PCIe x4 USB 3.2 Gen 2 expansion card (e.g., StarTech PEXUSB312A) | Adds dedicated host controllers to avoid root hub bandwidth contention |
| NIC | Dual 2.5 GbE or 10 GbE SFP+ | If backing up full device firmware images over the network |

### 5.3 Peripherals Identified in Video

| Item | Brand Detail | Replacement / Equivalent |
|------|--------------|--------------------------|
| Monitor | AOC (bottom bezel logo); model indeterminate | AOC 24B2XH / 27B2H series (~$120–180) |
| Keyboard | "VOC" branding (top-left) | Any generic USB HID; for lab use, consider a KVM if managing multiple control PCs |
| Mouse | Black + silver stripe; possible Logitech styling but unconfirmed | Logitech G102 / M720 or generic optical |
| Mouse pad | Razer green snake logo (Goliathus line) or Photoshop shortcut mat | Razer Goliathus Extended Chroma (~$50) |
| Microphone | Black gooseneck, wired 3.5 mm TRS or USB | Fifine K669B / Samson Go Mic (~$30–50) |

---

## 6. Stripped Phone PCB — Detailed Identification Guide

### 6.1 Typical Donor Device Specs (Reference Table)

These are the handsets most commonly found in stripping/click-farm supply chains because they are cheap, available in bulk, and have unlockable bootloaders:

| Device / SoC | CPU | RAM | Storage | Board Size (approx.) | Cell | Notes |
|--------------|-----|-----|---------|----------------------|------|-------|
| **Xiaomi Redmi 6A** (MediaTek Helio A22) | 4× Cortex-A53 @ 2.0 GHz | 2 GB LPDDR3 | 16 GB eMMC 5.1 | 145 × 55 mm | LTE Cat-4 | Very common; MIUI unlockable; boards ≈ $8–12 surplus |
| **Samsung Galaxy J2 Core** (Exynos 7570) | 4× Cortex-A53 @ 1.4 GHz | 1 GB LPDDR3 | 8 GB eMMC | 140 × 50 mm | LTE Cat-4 | Surplus from carrier refresh cycles; bootloader locked but ADB always available |
| **Xiaomi Redmi 9A** (MediaTek Helio G25) | 8× Cortex-A53 @ 2.0 GHz | 2 GB LPDDR4X | 32 GB eMMC 5.1 | 148 × 58 mm | LTE Cat-4 | More compute per watt; ≈ $12–18 stripped |
| **Huawei Y5 2019** (MediaTek Helio A22) | 4× Cortex-A53 @ 2.0 GHz | 2 GB LPDDR3 | 16 GB eMMC | 142 × 53 mm | LTE Cat-4 | Bootloader locked after 2018; useful only if already unlocked or for ADB-only use |
| **OPPO A1k** (MediaTek Helio P22) | 8× Cortex-A53 @ 2.0 GHz | 2 GB LPDDR3 | 32 GB eMMC | 145 × 55 mm | LTE Cat-4 | ColorOS; ADB present but deep sleep aggressive; useful for always-on testing |
| **ZTE Blade A3 2020** (Unisoc SC9832E) | 4× Cortex-A53 @ 1.4 GHz | 1 GB LPDDR3 | 8 GB eMMC | 138 × 48 mm | LTE Cat-4 | Cheapest tier; boards ≈ $5–8; slower eMMC limits I/O throughput |
| **Google Pixel 3a** (Snapdragon 670) | 2× A75 + 6× A55 | 4 GB LPDDR4X | 64 GB UFS 2.1 | 150 × 60 mm | LTE Cat-11 | Rare in bulk but excellent for security research (clean AOSP, guaranteed unlock) |

### 6.2 PCB Layout & Test Points

Stripped boards retain these standard features:

- **EMI shield cans**: Stamped aluminum or nickel-iron, soldered to the PCB. The main SoC + RAM stack is under the largest can. Remove with hot air (350°C, 2–3 min) or a shield-can opener tool if you need to probe BGA balls.
- **Test points**: Tiny via-sized copper pads, typically labeled with silkscreen:
  - `USB_DP` / `USB_DM` — direct access to D+/D− if the micro-USB/Type-C connector is damaged.
  - `UART_TX` / `UART_RX` — pre-bootloader serial console (Mediatek: 921600 baud; Qualcomm: 115200 baud).
  - `EMMC_D0`–`D7`, `EMMC_CLK`, `EMMC_CMD` — if you need to image flash directly (requires an eMMC reader like EasyJTAG / Z3X).
  - `B+`, `B−`, `NTC` — battery connector pads.
- **SIM socket**: Usually push-push or slide-in micro-SIM (3FF) holder; retains the SIM detect switch pin.
- **WiFi/BT antenna**: Ceramic chip or stamped metal; connected via U.FL/IPEX MHF4 coax to the SoC/BT combo chip. If the antenna is gone, solder a short wire (~31 mm for 2.4 GHz) or replace the U.FL pigtail.

### 6.3 Board Dimensions & Clearances

| Parameter | Typical Value | Tolerance |
|-----------|---------------|-----------|
| PCB length | 135–160 mm | ±1 mm |
| PCB width | 45–65 mm | ±0.5 mm |
| PCB thickness | 0.8 or 1.0 mm (budget phones); 1.2 mm (premium) | ±0.1 mm |
| Max component height (shield can) | 2.5–4.0 mm | — |
| Max component height (camera module if retained) | 6–10 mm | — |
| Screw hole spacing (mounting ears if present) | M2 × 3 mm standoff pattern | — |

---

## 7. Environmental & Reliability Specifications

| Parameter | Target | Notes |
|-----------|--------|-------|
| **Ambient operating temp** | 15°C – 35°C | Below 15°C, displays (if attached) ghost; above 35°C, SoC throttling becomes significant |
| **Relative humidity** | 30% – 70% RH (non-condensing) | Condensation on bare PCBs causes corrosion and shorting |
| **ESD protection** | Grounded wrist strap for operator; chassis grounded via 3-prong AC cord | Bare phone PCBs are unprotected; a 2 kV zap can kill the touch-controller IC |
| **Dust** | IP5X minimum — filtered intake | Dust on SoC shields acts as a thermal insulator |
| **Vibration** | Not rated; transport boards in anti-static foam | Road vibration can crack BGA joints on heavy EMI shields |
| **Altitude** | PSU derated above 2000 m | Mean Well LRS series derates ~10% at 2000 m |
| **Fire safety** | PSU has UL94-V0 enclosure; chassis should not enclose flammable Li-ion cells | The reference setup removes batteries entirely, eliminating this risk |

---

## 8. Recommended Software Stack

| Layer | Tool | Purpose |
|-------|------|---------|
| **OS** | Ubuntu 22.04 LTS or Debian 12 | Host OS; ADB, fastboot, and scrcpy packages available via apt |
| **Device orchestration** | DeviceFarmer (OpenSTF) | Web UI for remote screen control, ADB shell, APK install, screenshot capture |
| **Screen mirroring** | scrcpy v2.x + `--tcpip` | Lightweight; 1–3 ms latency over USB; supports HID keyboard injection |
| **Automation** | UI Automator 2 + Python `uiautomator2` library | Programmatic UI interaction across all nodes |
| **Logging** | `adb logcat -b all` piped to `socat` or `netcat` | Centralized syslog; use `pidcat` or Android Studio logcat for filtering |
| **CI/CD bridge** | Jenkins + Appium Grid | Trigger automated tests across all available devices after each build |
| **Network isolation** | dnsmasq + hostapd on dedicated NIC | Creates an isolated WiFi lab network for ADB-over-WiFi without touching production LAN |
| **Firmware image backup** | `dd if=/dev/block/mmcblk0` via rooted adb or SP Flash Tool (MTK) / QFIL (Qualcomm) | Full disk imaging before destructive testing |
| **Security testing** | Frida, Objection, Magisk | Instrument native libraries, bypass SSL pinning, install root if needed |

---

## 9. Bill of Materials — Example 20-Node Build

| Item | Qty | Unit Cost (USD) | Total | Sourcing Notes |
|------|-----|-----------------|-------|----------------|
| Stripped phone PCBs (e.g., Redmi 6A) | 20 | $10 | $200 | Surplus electronics wholesalers / recycling brokers |
| Aluminum extrusion frame (20×20, 2 m lengths) | 4 | $8 | $32 | MakerBeam, 8020.net, or local metal shop |
| Acrylic divider / card-guide plates (3 mm, laser-cut) | 22 | $2 | $44 | Ponoko / Sculpteo / local maker space |
| Mean Well LRS-350-5 PSU | 1 | $25 | $25 | Digi-Key, Mouser, AliExpress (verify genuine) |
| Copper busbar (3×10 mm, 300 mm) | 1 | $5 | $5 | Hardware store |
| 20 AWG silicone wire (red + black, 10 m each) | 2 | $6 | $12 | Amazon / hobby shop |
| USB micro-B / Type-C pigtails (20 cm, data-only) | 20 | $0.50 | $10 | Bulk USB cable assemblies |
| 7-port USB 3.0 hub (VL817) | 3 | $25 | $75 | Anker, Sabrent, or industrial vendors |
| 80 mm DC fan (ball bearing, 3000 RPM) | 1 | $8 | $8 | Noctua NF-A8 or Delta Electronics |
| Dust filter (200 × 200 mm, 50 PPI) | 2 | $3 | $6 | PC modding suppliers |
| M3 screws + T-nuts (100× assorted) | 1 | $10 | $10 | Hardware kit |
| Thermal pads (10×10 mm, 1 mm, 20×) | 1 | $8 | $8 | Amazon / thermal-grizzly equivalents |
| 10 kΩ resistors (thermistor bypass, 20×) | 1 | $1 | $1 | Any electronics distributor |
| **Total** | | | **$436** | Does not include control PC, monitor, or SIM bank |

**Cost per node**: ~$22 for chassis share + board + wiring. Scaling to 40 nodes mainly adds PCBs and wiring; the PSU, chassis, and hub cost are amortized.

---

## 10. Common Failure Modes & Diagnostics

| Symptom | Likely Cause | Diagnostic |
|---------|--------------|------------|
| Board won't boot, no LED | Missing NTC/ID resistor; PMIC brownout; dead board | Check VBAT at PMIC input with DMM; verify thermistor loop |
| Boots then reboots in 30 sec | Inadequate power supply (voltage sag under load); check with oscilloscope in AC coupling | Add bulk capacitance (1000 µF, 6.3 V) near board input |
| ADB device appears then disappears | USB VBUS back-powering hub; ground loop | Use data-only cables; ensure single-point ground |
| Overheating shutdown | Insufficient airflow; fan blocked; heatsink missing on high-TDP SoC | Point IR thermometer at EMI shield; verify 45°C ambient max |
| Cellular not registering | SIM not seated; antenna missing; modem IMEI blacklisted | Check `AT+CREG?` via serial console; verify antenna continuity |
| Intermittent touch / phantom touches | NTC line floating; PMIC glitching; proximity sensor unmasked | Ground unused sensor lines; check `dmesg` for sensor driver errors |

---

## 11. Build vs. Buy — Updated Matrix

| Component | DIY | Commercial | Recommendation |
|-----------|-----|------------|----------------|
| Chassis | $40–80, customizable | $150–400 (Schroff subrack) | DIY for <20 nodes; buy 19" subrack for labs with existing rack infrastructure |
| Power | $30–50 | $80–150 (programmable lab PSU) | DIY busbar is fine; buy if you need per-port current telemetry |
| USB hubs | $75 (3× 7-port consumer) | $400–800 (Acroname programmable) | Consumer hubs work for 90% of labs; Acroname if you need remote power cycle |
| Device management UI | Free (OpenSTF / scrcpy) | $500+/mo (AWS Device Farm, Sauce Labs) | Self-host OpenSTF for on-prem; cloud only if you need global device diversity |
| SIM bank | $80–200 (8-port OEM) | $500–2000 (Quectel / MultiTech branded) | OEM units from industrial suppliers are adequate for test labs |

---

## 12. Safety, Compliance, & Ethics Reminders

- **FCC / CE Part 15 (Intentional Radiators)**: Running 20+ cellular transmitters in close proximity may violate radio equipment rules outside a shielded room. For a university or corporate lab, use a **Faraday tent** or **screen room** (copper mesh, < 20 dB attenuation at 2 GHz minimum).
- **IMEI / regulatory labeling**: Stripped boards often lack labels. If you are returning devices to cellular networks, ensure they have valid, non-duplicated IMEIs — clone IMEIs are illegal in most jurisdictions.
- **Data sanitization**: Donor phones may retain personal data on eMMC. Always wipe with `fastboot -w` or direct eMMC erase before research use.
- **Export control**: Modem pools with certain Qualcomm chipsets are subject to EAR/ITAR restrictions in the US. Verify HS codes if importing industrial telecom gear.

---

*Document assembled from VLM-assisted frame analysis, public teardown knowledge, and open hardware design references. Revision 1.0 — 2025-04-25.*