FreeCalypso > hg > gsm-net-reveng
changeset 16:2daf8f209707
tcsm2-notes: initial observations on boards
author | Mychaela Falconia <falcon@freecalypso.org> |
---|---|
date | Wed, 29 May 2024 02:26:13 +0000 |
parents | 86a10ba0a1f8 |
children | 776229c5d640 |
files | tcsm2-notes/tr16 tcsm2-notes/trco |
diffstat | 2 files changed, 62 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tcsm2-notes/tr16 Wed May 29 02:26:13 2024 +0000 @@ -0,0 +1,32 @@ +TR16-S is the 16-channel transcoder card, providing 16 TRAU channels. +Examination of the board reveals the following major components: + +Global for the whole TR16-S: + +One Lattice ispLSI1032E: a programmable logic device, non-volatile configuration +bits inside. + +One CY62128BLL-70SI chip: 128K x 8 static RAM. + +Replicated 16x, one set for each TRAU channel: + +One DSP chip, has these markings in addition to TI logo: + + TRLPRB 1.1 + D36884PZ-66 + ADW-4BAORLW + +I had no success in finding any documentation for this DSP chip - was it one of +those semi-custom Skunkworks parts without public documentation? I surmise +(without any proof!) that it is probably based on C54x architecture. + +In addition to this DSP, there is one more chip replicated 16x per channel, one +next to each DSP: IDT 71V016, 64K x 16 static RAM. + +Note the absence of any flash or other non-volatile memory chips: there is +non-volatile storage of configuration bits inside the Lattic PLD, but that's +just logic, no code. The available documentation for TCSM2 strongly suggests +that operational DSP code is loaded from TRCO, presumably on each system boot, +but what about boot code, how does the "cold" TR16-S card communicate with TRCO? +The custom DSP ASICs probably have some ROM in them, supporting boot and maybe +providing some common routines or tables for the operational code, who knows...
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tcsm2-notes/trco Wed May 29 02:26:13 2024 +0000 @@ -0,0 +1,30 @@ +Major components on TRCO board: + +1x Lattice ispLSI1032E PLD, same as on TR16-S +1x CPU: Intel TN80C186EB20 + +1x really big oscillator component, labeled 16.384 MHz, likely OCXO +1x MAS9316N DAC close to it - likely TDM common clock for the system + +3x Infineon chips, 2x SAB 82525 (2x HDLC) and 1x SAB 82526 (1x HDLC): +the 5 HDLC channels which the available documentation touches on + +8x PLCC32 chips (9 pins on wide side, 7 pins on narrow side) with stickers +on them that obscure the markings underneath. The markings read IC45 through +IC48 in the top row of 4, IC55 through IC58 in the bottom row of 4. All 8 +ICs are directly soldered. Suspected flash memory. + +Next to these 8 ICs there is a socketed PLCC44 IC (11 pins on each side) +with a sticker that reads: + + TRCO + 6.1-0 + TC1ROMQL + +It is clearly a programmed part of some kind, but not clear if it is flash +(boot code?) or some PLD or whatever. + +Further insight can be gained by peeling off the stickers, but I am not going +there yet: my current plan is to try powering this unit as-is and see if it +comes to life in a useful way. If it turns out to lack the needed fw, or lack +TFO feature, then proceed further with reverse eng.