This is a chip aimed at the automotive market – this is a low power voltage regulator for supplying power to microcontrollers, for instance in a CD player.
TDA3606 Die
The TDA3606 is a voltage regulator intended to supply a microprocessor (e.g. in car radio applications). Because of low voltage operation of the application, a low-voltage drop regulator is used in the TDA3606. This regulator will switch on when the supply voltage exceeds 7.5 V for the first time and will switch off again when the output voltage of the regulator drops below 2.4 V. When the regulator is switched on, the RES1 and RES2 outputs (RES2 can only be HIGH when RES1 is HIGH) will go HIGH after a fixed delay time (fixed by an external delay capacitor) to generate a reset to the microprocessor. RES1 will go HIGH by an internal pull-up resistor of 4.7 kΩ, and is used to initialize the microprocessor. RES2 is used to indicate that the regulator output voltage is within its voltage range. This start-up feature is built-in to secure a smooth start-up of the microprocessor at first connection, without uncontrolled switching of the regulator during the start-up sequence. All output pins are fully protected. The regulator is protected against load dump and short-circuit (foldback
current protection). Interfacing with the microprocessor can be accomplished by means of a battery Schmitt-trigger and output buffer (simple full/semi on/off logic applications). The battery output will go HIGH when the battery input voltage exceeds the HIGH threshold level.
I recently got the latest upgrade from Virgin Media, 200Mbit DL / 20Mbit UL, and to get this I was informed I’d have to buy their latest hardware, since my existing CPE wouldn’t be able to handle the extra 5Mbit/s upload speed. (My bullshit detector went off pretty hard at that point, as the SuperHub 2 hardware is definitely capable of working fine with 20Mbit/s upload rates). Instead of having to return the old router, I was asked to simply recycle it, so of course the recycling gets done in my pretty unique way!
Mainboard
The casing of these units is held together by a single screw & a metric fuckton of plastic clips, disassembly is somewhat hindered by the radio antennas being positioned all over both sides of the casing. Once the side is off, the mainboard is visible. The DOCSIS frontend is lower left, centre is the Intel PUMA 5 Cable Modem SoC with it’s RAM just to the lower right. The right side of the board is taken up by both of the WiFi radio frontends, the 5GHz band being covered by a Mini PCIe card.
Atheros Gigabit Switch
The 4 gigabit Ethernet ports on the back are serviced by an Atheros AR8327 Managed Layer 3 switch IC, which seems to be a pretty powerful device:
The AR8327 is the latest in high performance small network switching. It is ultra low power, has extensive routing and data management functions and includes hardware NAT functionality (AR8327N). The AR8327/AR8327N is a highly integrated seven-port Gigabit Ethernet switch with a fully non-blocking switch fabric, a high-performance lookup unit supporting 2048 MAC addresses, and a four-traffic class Quality of Service (QoS) engine. The AR8327 has the flexibility to support various networking applications. The AR8327/AR8327N is designed for cost-sensitive switch applications in wireless AP routers, home gateways, and xDSL/cable modem platforms.
Unfortunately most of the features of this router are locked out by VM’s extremely restrictive firmware. With any of their devices, sticking the VM supplied unit into modem mode & using a proper router after is definitely advised!
Intel Puma 5 CM CPU
The cable modem side of things is taken care of by the Intel PUMA 5 DNCE2530GU SoC. This appears to communicate with the rest of the system via the Ethernet switch & PCI Express for the 5GHz radio.
Atheros WiFi SoC
The 2.4GHz radio functionality is supplied by an Atheros AR9344 SoC, it’s RAM is to the left. This is probably handling all the router functions of this unit, but I can’t be certain.
Atheros LAN PHY
A separate Ethernet PHY is located between the SoC & the switch IC.
5GHz Radio Card
The 5GHz band is served by a totally separate radio module, in Mini PCIe format, although it’s a bit wider than standard. This module will probably be kept for reuse in another application.
Power Supplies
All down the edge of the board are the multiple DC-DC converters to generate the required voltage rails.
MaxLinear MXL261 Frontend
The DOCSIS frontend is handled by a MaxLinar MXL261 Tuner/Demodulator. More on this IC in my decapping post 🙂
The Unknown One
I’ve honestly no idea what on earth this Maxim component is doing. It’s clearly connected via an impedance matched pair, and that track above the IC looks like an antenna, but nothing I search for brings up a workable part number.
2.4GHz Frontend
The RF switching & TX amplifiers are under a shield, these PA chips are SiGe parts.
Atheros 5GHz Radio
Pretty much the same for the 5GHz radio, but with 3 radio channels.
This particular IC came out of a very old VHF band radio, from the early 90’s. The die was encased in a custom ceramic package, like every other IC in the radio, with a custom part number. I managed to identify it from the markings on the silicon.
Motorola MC68HC11L6
This was a pretty powerful MCU for it’s time, with 16K of onboard ROM, 512 bytes of both RAM & EEPROM, a 16-bit timer, 8-bit ADC, SPI & a MC68HC11 CPU core.
If you’ve found my content useful, please consider making a donation via the link below!
All collected funds go towards new content & the costs of keeping the servers online.
