Posted on Leave a comment

Sky+ HD Set Top Box

Sky Box
Sky Box

Time for another teardown! I managed to fish this Sky+ box out of a skip, but to protect the guilty, all serial numbers have been removed.
These are pretty smart devices, with DVR capability on board.

Ports 1
Ports 1

There’s a lot of ports on these units, from RS-232 serial, POTS modem, eSATA, HDMI, USB, Ethernet, SCART, Optical, digital outputs & even composite video.

Ports 2
Ports 2
Ports 3
Ports 3
Top Panel
Top Panel

Removing the top plastic cover reveals the operation buttons & the built in WiFi adaptor, which is USB connected to the main logic board.

Front Panel
Front Panel

The PCB on the front of the chassis has all the indicators, and the IR Receiver for the remote.

Cover Removed
Cover Removed

Removing the top shield of the chassis reveals the innards. The PSU is on the top right, 500GB SATA disk drive in the bottom centre. The main logic PCB is top centre.

Logic PCB
Logic PCB

Here’s the main logic PCB. The massive heatsink in the middle is cooling the main SoC, below.

SoC
SoC

The main SoC in this unit is a Broadcom BCM7335 HD PVR Satellite System-On-Chip. It’s surrounded by it’s boot flash, a Spansion GL512P10FFCR1 512Mbit NOR device. It’s also got some DRAM around the left edge.

Smart Card Reader
Smart Card Reader

The smart card reader is on the PSU PCB, the controller here is an NXP TDA8024

PSU PCB
PSU PCB

The PSU itself is a pretty standard SMPS, so I won’t go too far into that particular bit. The logic PCB attaches to the large pin header on the left of the PSU, some of the analogue video outputs are also on this board.
There’s also a Microchip PIC16F726 microcontroller on this PCB, next to the pin header. Judging by the PCB traces, this handles everything on the user control panel.

Power Supplies
Power Supplies

Some local supplies are provided on the logic board for the main SoC, the IC in the centre here is an Allegro A92 DC-DC converter. I didn’t manage to find a datasheet for this one.

LNB Front End
LNB Front End

The RF front end for the satellite input is a Broadcom BCM3445 Low Noise Amplifier & Splitter, again not much info on this one.

RS232 Section
RS232 Section

The standard MAX232 is used for the serial interface. I imagine this is for diagnostics.

Modem
Modem

The POTS modem section is handled by a Si2457 System-Side device & Si3018 Line-Side device pair.

Posted on Leave a comment

IC Decap: Motorola XPC860PZP50D4 Communications Controller

XPC860PZP50D4 Package
XPC860PZP50D4 Package

This is a System On Chip from Motorola, designed for network routing applications. This chip contains a hell of a feature set, so I’ll just include an excerpt from the datasheet:

XPC860PZP50D4 Die
XPC860PZP50D4 Die

Posted on Leave a comment

Mini Teardown: Eberspacher 701 BT Controller

It’s well known that there are two versions of the 701 type controller available for Eberspacher heaters, the version with the blue logo is the official un-restricted model, while the version with the white logo is a version built for BT that restricts the heater to 1 hour runtime & has no diagnostics built in.
As these devices are microcontroller driven, I assumed that the hardware would be the same, only the code running in the micro being the bit that Eberspacher changed. This option would certainly have been the lowest cost.

Controller PCB Rear
Controller PCB Rear

Here’s the PCB removed from the plastic housing. There are definitely some differences that I can tell. As the un-restricted version has an extra wire for the diagnostic serial interface, and this board has no unpopulated parts, the PCB is definitely a different version.
In the centre is a Microchip PIC16C622 microcontroller, the OTP version in this case for cost reductions. (I may try reading the binary from this chip in the future, chances are it’s code protected though).
Below the micro is an NXP PCF8577C 32-segment LCD controller, this has an I²C interface to the PIC.
The temperature control function on these heaters is done via applying a resistance to one of the control lines, between 1750Ω-2180Ω, ±80Ω. (Very odd values these, not to mention no standard components can create this range easily, bloody engineers >_<). This is accomplished in hardware with a BU2092F I²C shift register from Rohm, which is connected to a bank of resistors. The microcontroller will switch combinations of these into the circuit to get the range of resistances required.
The rest of the circuit is local power regulation & filtering.

Controller PCB Front
Controller PCB Front

There’s not much on the other side of the PCB, just the LCD itself & the contacts for the buttons.