Posted on 8 Comments

Virgin Media Superhub 2 Teardown

I recently got the latest upgrade from Virgin Media, 200Mbit DL / 20Mbit UL, and to get this I was informed I’d have to buy their latest hardware, since my existing CPE wouldn’t be able to handle the extra 5Mbit/s upload speed. (My bullshit detector went off pretty hard at that point, as the SuperHub 2 hardware is definitely capable of working fine with 20Mbit/s upload rates). Instead of having to return the old router, I was asked to simply recycle it, so of course the recycling gets done in my pretty unique way!

Mainboard
Mainboard

The casing of these units is held together by a single screw & a metric fuckton of plastic clips, disassembly is somewhat hindered by the radio antennas being positioned all over both sides of the casing. Once the side is off, the mainboard is visible. The DOCSIS frontend is lower left, centre is the Intel PUMA 5 Cable Modem SoC with it’s RAM just to the lower right. The right side of the board is taken up by both of the WiFi radio frontends, the 5GHz band being covered by a Mini PCIe card.

Atheros Gigabit Switch
Atheros Gigabit Switch

The 4 gigabit Ethernet ports on the back are serviced by an Atheros AR8327 Managed Layer 3 switch IC, which seems to be a pretty powerful device:

The AR8327 is the latest in high performance small network switching. It is ultra low power, has extensive routing and data management functions and includes hardware NAT functionality (AR8327N). The AR8327/AR8327N is a highly integrated seven-port Gigabit Ethernet switch with a fully non-blocking switch fabric, a high-performance lookup unit supporting 2048 MAC addresses, and a four-traffic  class Quality of Service (QoS) engine. The AR8327 has the flexibility to support various networking applications. The AR8327/AR8327N is designed for cost-sensitive switch applications in wireless AP routers, home gateways, and xDSL/cable modem platforms.

Unfortunately most of the features of this router are locked out by VM’s extremely restrictive firmware. With any of their devices, sticking the VM supplied unit into modem mode & using a proper router after is definitely advised!

Intel Puma 5 CM CPU
Intel Puma 5 CM CPU

The cable modem side of things is taken care of by the Intel PUMA 5 DNCE2530GU SoC. This appears to communicate with the rest of the system via the Ethernet switch & PCI Express for the 5GHz radio.

Atheros WiFi SoC
Atheros WiFi SoC

The 2.4GHz radio functionality is supplied by an Atheros AR9344 SoC, it’s RAM is to the left. This is probably handling all the router functions of this unit, but I can’t be certain.

Atheros LAN PHY
Atheros LAN PHY

A separate Ethernet PHY is located between the SoC & the switch IC.

 

5GHz Radio Card
5GHz Radio Card

The 5GHz band is served by a totally separate radio module, in Mini PCIe format, although it’s a bit wider than standard. This module will probably be kept for reuse in another application.

Power Supplies
Power Supplies

All down the edge of the board are the multiple DC-DC converters to generate the required voltage rails.

MaxLinear MXL261 Frontend
MaxLinear MXL261 Frontend

The DOCSIS frontend is handled by a MaxLinar MXL261 Tuner/Demodulator. More on this IC in my decapping post 🙂

The Unknown One
The Unknown One

I’ve honestly no idea what on earth this Maxim component is doing. It’s clearly connected via an impedance matched pair, and that track above the IC looks like an antenna, but nothing I search for brings up a workable part number.

2.4GHz Frontend
2.4GHz Frontend

The RF switching & TX amplifiers are under a shield, these PA chips are SiGe parts.

Atheros 5GHz Radio
Atheros 5GHz Radio

Pretty much the same for the 5GHz radio, but with 3 radio channels.

Posted on 2 Comments

nb Tanya Louise Heating Upgrades – The Pumps

 

Pierburg WUP1
Pierburg WUP1

With some recent upgrades to the boat’s heating system, the hot water circulation pumps we’ve been using are becoming far too small for the job. After the original Johnson Marine circulation pump died of old age (the brushes wore down so far the springs ate the commutator) some time ago, it was replaced with a Pierburg WUP1 circulation pump from a BMW. (As we’re moored next to a BMW garage, these are easily obtainable & much cheaper than the marine pumps).

WUP1 Cutaway
WUP1 Cutaway

These are also brushless, where as the standard Johnson ones are brushed PM motors – the result here is a much longer working life, due to fewer moving parts.

The rated flow & pressure on these pumps is pretty pathetic, at 13L/min at 0.1bar head pressure. As the boat’s heating system is plumbed in 15mm pipe instead of 22mm this low pressure doesn’t translate to a decent flow rate. Turns out it’s pretty difficult to shove lots of water through ~110ft of 15mm pipe ;). Oddly enough, the very low flow rate of the system was never a problem for the “high output” back boiler on the stove – I suspect the “high output” specification is a bit optimistic.
This issue was recently made worse with the addition of a Webasto Thermo Top C 5kW diesel-fired water heater, which does have it’s own circulation pump but the system flow rate was still far too low to allow the heater to operate properly. The result was a rapidly cycling heater as it couldn’t dump the generated hot water into the rest of the system fast enough.

The easiest solution to the problem here is a larger pump with a higher head pressure capability. (The more difficult route would be completely re-piping the system in 22mm to lower the flow resistance). Luckily Pierburg produce a few pumps in the range that would fit the job.

Pierburg CWA-50
Pierburg CWA-50

Here’s the next size up from the original WUP1 pump, the CWA50. These are rated at a much more sensible 25L/min at 0.6bar head pressure. It’s physically a bit larger, but the connector sizes are the same, which makes the install onto the existing hoses easier. (For those that are interested, the hose connectors used on BMW vehicles for the cooling system components are NormaQuick PS3 type. These snap into place with an O-Ring & are retained by a spring clip).
The CWA50 draws considerably more power than the WUP1 (4.5A vs 1.5A), and are controllable with a PWM signal on the connector, but I haven’t used this feature. The PWM pin is simply tied to the positive supply to keep the pump running at maximum speed.

Once this pump was installed the head pressure immediately increased on the gauge from the 1 bar static pressure to 1.5 bar, indicating the pump is running at about it’s highest efficiency point. The higher water flow has so far kept the Webasto happy, there will be more to come with further improvements!

CWA-50 Pump Teardown

CWA50 Cutaway
CWA50 Cutaway

Above is a cutaway drawing of the new pump. These have a drilling through the shaft allows water to pass from the high pressure outlet fitting, through the internals of the pump & returns through the shaft to the inlet. This keeps the bearings cool & lubricated. The control & power drive circuitry for the 3-phase brushless motor is attached to the back & uses the water flowing through the rotor chamber as a heatsink. Overall these are very well made pumps.

Impeller
Impeller

Here’s the impeller of the pump, which is very small considering the amount of power this unit has. The return port for the lubricating water can be seen in the centre of the impeller face.

3-Phase Driver
3-Phase Driver

Inside the back of the pump is the control module. The main microcontroller is hiding under the plastic frame which holds the large power chokes & the main filter electrolytic.

Posted on Leave a comment

Mercedes Benz Temic Central Locking / Immobilizer Module Teardown

Mercedes Benz Temic Module
Mercedes Benz Temic Module

The other day I was given a random pile of car electronic parts from the scrap bin at the local garage, so I decided to do a few teardowns. This first one is a Temic Central Locking / Immobiliser module from a Mercedes van. Judging by the 125kHz stamped on the label, this also has RFID capability.

PCB
PCB

The casing just unclips, revealing the PCB. Surprisingly for an automotive module, there is no conformal coating on this (they’re usually heavily coated in protective lacquer to prevent moisture ingress).

Microcontroller
Microcontroller

The large IC from Motorola I’m assuming to be a microcontroller, but I didn’t manage to find anything from the markings. There’s not much else in here apart from some glue logic, and what I think is the 125Khz toroidal antenna in the top left corner.