Hardware¶
Teardown video of UK version: https://www.youtube.com/watch?v=RnI5dhKhYFw
DE version:
Physical Setup / Board Stacking¶
The hardware consists of two circuit boards:
- PSU board (top): AC/DC power supply and Ethernet switch
- main board (bottom): Actual Femtocell mainboard
- 6-pin fine-pitch connector (most likely for DC power)
- flexible printed circuit cable (most likely for Ethernet MII/RMII)
- two large sheet metal parts for ground and/or thermal connection
To operate he opened device in a safe way (i.e. without live AC line voltage present) you can inject 4.0V DC using an external power supply.
One method is to connect using a crocodile clip the ground of the external power supply to one of the two large metal plates interconnecting the two boards, and connect the 4.0V DC of the external power supply to the long vertical pin headers 1 and 2 of J5 interconnecting the two boards (also using a crocodile clip).
Without radio enable the device uses on average 400 mA with peaks at 2.5 A.
It seems also feasible to use a 5V power supply (still capable of at least 2.5 A) instead of 4.0V. The LDOs will get a bit warmer but it seems sustainable.
Major Components¶
Femtocell SoC (U3)¶
Broadcomm BCM61610KFB1G (formerly Percello)- no information found anywhere
- probably derivative of PRC6100
- probably derivative of PRC6000
- contains MIPS24Kc core
NAND Flash (U40)¶
Hynix H27U1G8F2BTR- 1Gbit (256MByte) NAND Flash, x8 data bus, 3.3V, 2k page size, 128k erase block, 48pin TSOP1
- http://natisbad.org/NAS/refs/Hynix_NAND_128Mo_H27U1G8F2BT.pdf
RF Transceiver¶
Maxim MAX2550- Band I, V, and VIII WCDMA Femtocell Transceiver with GSM Monitoring
- https://www.maximintegrated.com/en/products/comms/wireless-rf/MAX2550.html
- https://datasheets.maximintegrated.com/en/ds/MAX2550.pdf
- https://www.maximintegrated.com/en/app-notes/index.mvp/id/5364
Ethernet Switch¶
Atheros AR8236-AL1A- 6-port Fast Ethernet Switch
- https://wikidevi.com/files/Atheros/specsheets/AR8326.pdf
- http://jhongtech.com/DOWN/ATHEROS--AR8236.pdf
AC/DC switching power supply controller¶
RF LDO (WU1)¶
- AP2318 Adjustable ULDO in DFN3x3-8
Connectors¶
Mainboard J2¶
- 12pos 2x6 1.27mm pitch header
- unpopulated
- likely (MIPS) JTAG and UART
Function | Pin | Pin | Function |
---|---|---|---|
GND | 1 | 2 | 3V3 |
idle low | 3 | 4 | idle high |
idle low | 5 | 6 | idel high |
UART_RXD | 7 | 8 | idle high |
UART_TXD | 9 | 10 | idle 400 mV |
idle high | 11 | 12 | idle high |
By default the UART port only shows the Bootlog, but no terminal console is provided.
The boot sequence can also not be interrupted.
(!) warning: do not connect these lines to your computer if the device is plugged to and powered by mains electricity. At best this will trigger the residual current circuit breaker of your household. To be able to connect to these pins you have to power the board using and external (isolated) power supply.
Mainboard J3¶
- 30pos 0.5mm pitch FPC
- connects to PSU Board CON1
- likely LED + AR8236 (R)MII + AR8236 SPI + AR8236 UART
Mainboard J4¶
- 3pos 2.54mm pitch hader, center pos missing
- used to supply 230V AC from mainboard to PSU board
- connects to PSU Board J4
Mainboard J5¶
- 8pos 2x4 1.27mm pitch SMD header
- DC power input
- connects to PSU-Board J
Pin | Function |
---|---|
1 | 4V DC (supply for LDOs on mainboard) |
2 | 4V DC (supply for LDOs on mainboard) |
3 | GND |
4 | GND |
5 | GND |
6 | GND |
7 | 3.3V DC (regulated on PSU board for Ethernet Switch) |
8 | 3.3V DC (regulated on PSU board for Ethernet Switch) |
PSU-Board U9¶
Yellow RJ45 mag-jack, connected to Port 0 of AR8236
PSU-Board U8¶
Grey RJ45 mag-jack, connected to Port 3 of AR8236
Updated by tsaitgaist almost 7 years ago · 22 revisions