Miscellaneous Projects » SuperSignal AP 2820V

h1. Hardware

Teardown video of UK version: https://www.youtube.com/watch?v=RnI5dhKhYFw

h2. Physical Setup / Board Stacking

The hardware consists of two circuit boards:

* Top board: AC/DC power supply and Ethernet switch

* Bottom board: Actual Femtocell mainboard

The two boards are sandwiched together by the following connections:

* 6-pin fine-pitch connector (most likely for DC power)

* flexible printed circuit cable (most likely for Ethernet MII/RMII)

* two large sheet metal parts for ground and/or thermal connection

It is thus not very straight forward to operate the opened device in a safe way (i.e. without live AC line voltage present).

We will be working on a way to operate it with injected safe low DC voltage, but that is still TBD.

h2. Major Components

h3. Femtocell SoC (U3)

Broadcomm BCM61610KFB1G (formerly Percello)

* no information found anywhere

* probably derivative of PRC6100

** http://www.node-h.com/en/news/article/Node-H_3GPP_Iu-h_Femtocell_Software_is_Standards_Compliant.php

** https://www.s3group.com/semiconductor-solutions/s3-percello-collaborate-produce-latest-femtocell-baseband-processor/

* probably derivative of PRC6000

** https://www.bdti.com/InsideDSP/2008/10/15/Percello

* contains MIPS24Kc core

h3. NAND Flash (U40)

Hynix H27U1G8F2BTR

* 1Gbit (256MByte) NAND Flash, x8 data bus, 3.3V, 2k page size, 128k erase block, 48pin TSOP1

* http://natisbad.org/NAS/refs/Hynix_NAND_128Mo_H27U1G8F2BT.pdf

h3. RF Transceiver

Maxim MAX2550

* Band I, V, and VIII WCDMA Femtocell Transceiver with GSM Monitoring

* https://www.maximintegrated.com/en/products/comms/wireless-rf/MAX2550.html

* https://datasheets.maximintegrated.com/en/ds/MAX2550.pdf

* https://www.maximintegrated.com/en/app-notes/index.mvp/id/5364

h3. Ethernet Switch

Atheros AR8236-AL1A

* 6-port Fast Ethernet Switch

* https://wikidevi.com/files/Atheros/specsheets/AR8326.pdf

* http://jhongtech.com/DOWN/ATHEROS--AR8236.pdf

h3. AC/DC switching power supply controller

* https://www.power.com/sites/default/files/product-docs/linkcv_family_datasheet.pdf

h3. RF LDO (WU1)

* AP2318 Adjustable ULDO in DFN3x3-8

** https://www.diodes.com/assets/Datasheets/AP2318.pdf

h2. Connectors

h3. Mainboard J2

* 12pos 2x6 1.27mm pitch header

* unpopulated

* likely (MIPS) JTAG and UART

|_.Function|_.Pin|_.Pin|_.Function|

|GND|1|2|3V3|

|idle low|3|4|idle high|

|idle low|5|6|idel high|

|UART_RXD|7|8|idle high|

|UART_TXD|9|10|idle 400 mV|

|idle high|11|12|idle high|

By default the UART port only shows the [[Bootlog]], but no terminal console is provided.

The boot sequence can also not be interrupted.

h3. Mainboard J3

* 30pos 0.5mm pitch FPC

* connects to PSU Board CON1

* likely LED + AR8236 (R)MII + AR8236 SPI + AR8236 UART

h3. Mainboard J4

* 3pos 2.54mm pitch hader, center pos missing

* used to supply 230V AC from mainboard to PSU board

* connects to PSU Board J4

h3. Mainboard J5

* 8pos 2x4 1.27mm pitch SMD header

* DC power input

* connects to PSU-Board J

|_.Pin|_.Function|

|1|4V DC (supply for LDOs on mainboard)|

|2|4V DC (supply for LDOs on mainboard)|

|3|GND|

|4|GND|

|5|GND|

|6|GND|

|7|3.3V DC (regulated on PSU board for Ethernet Switch)|

|8|3.3V DC (regulated on PSU board for Ethernet Switch)|

h3. PSU-Board U9

Yellow RJ45 mag-jack, connected to Port 0 of AR8236

h3. PSU-Board U8

Grey RJ45 mag-jack, connected to Port 3 of AR8236