Miscellaneous Projects » SuperSignal AP 2820V

h1. Hardware

Teardown video of UK version: https://www.youtube.com/watch?v=RnI5dhKhYFw

DE version:

{{thumbnail(board-case-front.jpg, size=200)}}

{{thumbnail(board-case-back.jpg, size=200)}}

{{thumbnail(board-case-bottom.jpg, size=150)}}

{{thumbnail(inside.jpg, size=200)}}

{{thumbnail(board-net-front.jpg, size=200)}}

{{thumbnail(board-net-back.jpg, size=200)}}

{{thumbnail(board-proc-front.jpg, size=200)}}

{{thumbnail(board-proc-back.jpg, size=200)}}

{{thumbnail(board-proc-back-naked.jpg, size=200)}}

{{thumbnail(board-proc-back-processor.jpg, size=200)}}

h2. Physical Setup / Board Stacking

The hardware consists of two circuit boards:

* Top board: AC/DC power supply and Ethernet switch

* Bottom board: Actual Femtocell mainboard

The two boards are sandwiched together by the following connections:

* 6-pin fine-pitch connector (most likely for DC power)

* flexible printed circuit cable (most likely for Ethernet MII/RMII)

* two large sheet metal parts for ground and/or thermal connection

It is thus not very straight forward to operate the opened device in a safe way (i.e. without live AC line voltage present).

We will be working on a way to operate it with injected safe low DC voltage, but that is still TBD.

h2. Major Components

h3. Femtocell SoC (U3)

Broadcomm BCM61610KFB1G (formerly Percello)

* no information found anywhere

* probably derivative of PRC6100

** http://www.node-h.com/en/news/article/Node-H_3GPP_Iu-h_Femtocell_Software_is_Standards_Compliant.php

** https://www.s3group.com/semiconductor-solutions/s3-percello-collaborate-produce-latest-femtocell-baseband-processor/

* probably derivative of PRC6000

** https://www.bdti.com/InsideDSP/2008/10/15/Percello

* contains MIPS24Kc core

h3. NAND Flash (U40)

Hynix H27U1G8F2BTR

* 1Gbit (256MByte) NAND Flash, x8 data bus, 3.3V, 2k page size, 128k erase block, 48pin TSOP1

* http://natisbad.org/NAS/refs/Hynix_NAND_128Mo_H27U1G8F2BT.pdf

h3. RF Transceiver

Maxim MAX2550

* Band I, V, and VIII WCDMA Femtocell Transceiver with GSM Monitoring

* https://www.maximintegrated.com/en/products/comms/wireless-rf/MAX2550.html

* https://datasheets.maximintegrated.com/en/ds/MAX2550.pdf

* https://www.maximintegrated.com/en/app-notes/index.mvp/id/5364

h3. Ethernet Switch

Atheros AR8236-AL1A

* 6-port Fast Ethernet Switch

* https://wikidevi.com/files/Atheros/specsheets/AR8326.pdf

* http://jhongtech.com/DOWN/ATHEROS--AR8236.pdf

h3. AC/DC switching power supply controller

* https://www.power.com/sites/default/files/product-docs/linkcv_family_datasheet.pdf

h3. RF LDO (WU1)

* AP2318 Adjustable ULDO in DFN3x3-8

** https://www.diodes.com/assets/Datasheets/AP2318.pdf

h2. Connectors

h3. Mainboard J2

* 12pos 2x6 1.27mm pitch header

* unpopulated

* likely (MIPS) JTAG and UART

|_.Function|_.Pin|_.Pin|_.Function|

|GND|1|2|3V3|

|idle low|3|4|idle high|

|idle low|5|6|idel high|

|UART_RXD|7|8|idle high|

|UART_TXD|9|10|idle 400 mV|

|idle high|11|12|idle high|

By default the UART port only shows the [[Bootlog]], but no terminal console is provided.

The boot sequence can also not be interrupted.

(!) *warning*: do not connect these lines to your computer if the device is plugged to and powered by mains electricity. At best this will trigger the residual current circuit breaker of your household. To be able to connect to these pins you have to power the board using and external (isolated) power supply.

h3. Mainboard J3

* 30pos 0.5mm pitch FPC

* connects to PSU Board CON1

* likely LED + AR8236 (R)MII + AR8236 SPI + AR8236 UART

h3. Mainboard J4

* 3pos 2.54mm pitch hader, center pos missing

* used to supply 230V AC from mainboard to PSU board

* connects to PSU Board J4

h3. Mainboard J5

* 8pos 2x4 1.27mm pitch SMD header

* DC power input

* connects to PSU-Board J

|_.Pin|_.Function|

|1|4V DC (supply for LDOs on mainboard)|

|2|4V DC (supply for LDOs on mainboard)|

|3|GND|

|4|GND|

|5|GND|

|6|GND|

|7|3.3V DC (regulated on PSU board for Ethernet Switch)|

|8|3.3V DC (regulated on PSU board for Ethernet Switch)|

h3. PSU-Board U9

Yellow RJ45 mag-jack, connected to Port 0 of AR8236

h3. PSU-Board U8

Grey RJ45 mag-jack, connected to Port 3 of AR8236