I recently acquired an unused verizon frountier FiOS home box, aka an ONT (optical network terminator) and tore it apart because I've never found any teardown information available about them online.

Teardowns seem to go two ways, there's the industrial side of things where all the components are well marked but are expensive or difficult to get and datasheets are commonly not available to the public. Then there's the consumer side of things where most of the components are readily available but manufactures have lasered off identification numbers and logos, probably to make my job more difficult because there are others trying to do the same thing to undermine their profits. The ONT falls well into the industrial category. Despite being attached to everyone's house its really not a consumer device; we don't interact with them much, they're directly in contact with your ISP's enterprise infrastructure and you don't really get to shop around for the model you like.

Systems

I broke the ONT down into three major systems.

  • Battery
    • Power supply and backup
    • Usually inside residence?
  • Main board
    • Networking, cable tv & telephone
    • Enclosed in weatherproof box.
  • Fiber transceiver
    • Converts optical signal to RF for main board to process
    • Enclosed in weatherproof box.

Chips & Modules

Battery

Fairly standard 12V sealed lead acid battery, 7.2Ah. Charge controller seems regular too. 7-8 color coded wires connect the charge controller to the main board, I assume this is for different voltages, health monitoring and control.


Fiber transceiver

This module is made by emcore and appears to be model Y183-113-001A although the pcb inside is labeled G9823. I can't find any information about it.

The module turns the incoming fiber optic signal into an outgoing RF signal and an incoming RF signal into an outgoing optic signal. It probably uses wavelength division multiplexing and you can clearly see three optic devices attached into some sort of beamsplitter that directs the proper wavelength into the proper silicon. There's probably two photodiodes and one infrared laser diode given that you get so much more downstream bandwidth than upstream.

The whole thing was mounted in a pretty heavy metal case and a couple of the chips inside were in thermal contact with the metal. I assume these were receiver amplifiers or the laser driver for the transmitter.

The only real mystery is the 0.1" header on one side of the module that fits into a socket on the main board. It carries power but I'm not sure what else.

Observed chips:

  • LT? 901 1665l (voltage regulator?)
  • SI Labs F311 BCN01D 0903+ (MCU)
  • 4003 EUA (Maxim RF detector?)
  • 290 4 (Op-amp?)
  • 3658E TG352 INDL (Transimpedance preamp?)
  • N1 903G 501S (?)

Main board

The main board connects to the fiber transceiver with a small coax cable and a pin header. It regulates all the power and somehow provides us with an outgoing coax connection for cable tv and internet, an rj-45 ethernet jack and POTS telephone connections (including external telephone test points). There is a label on the PCB that reads "533462-005-00 REV B".

There's also like 10 status LEDs. There is a four pin header in the middle of the board for an unknown purpose, a similarly mysterious unpopulated 14 pin header, an unpopulated 2 pin header and an unpopulated spot for what's probably 10 pin JTAG.

The front side of the board is dominated by one large broadcom gigabit ethernet transceiver chip, a BCM5481 in the bottom right corner. There's also a TI431 voltage reference connected to a 2903 comparator and a few hex inverters. This side also has all the connection hardware for POTS, ethernet, telephone test points and coax.

The back side has the majority of the chips, the largest being a broadlight BL2338R ONT SoC in BGA package. The only information I can find about it is that its a GPON (gigabit passive optical network) processor. This chip does most of the computation in the ONT; running high speed network interfaces with its dual-core "runner" network processor and VOIP that might provide the ONT with POTS (this is disputed because there's also a dedicated VOIP processor). According to the spec sheet it only takes 900mA.

Complementing the processor is a 128mb flash memory chip from Spansion and a ram chip of unknown size labeled "9cb41 d9frf". Other interesting small chips around the processor include a couple SC4215 regulators and two PI1622BE tristate 12-24 bit bus exchangers.

Also in the corner is an entropic en2211-b1, which I could find no information on. I assume its similar enough to the entropic en2210 which is a coaxial network controller. This must be what's responsible for stuffing data like cable internet into the coax that feeds into the house.

Just above this here's a large section on the board that appears to be designed to have a shield soldered in place (there wasn't one). This probably generates and controls carrier signals for the coax lines. There's another entropic chip here, looks like an en1010, something to do with coax control. In the same region is a small silver insulated component that I believe is an L466 inductor.

Nearby but outside of the footprint of the unpopulated shield is a shielded module from Macom marked MAFL-008195-CD0AC0. Its listed as a surface mount diplex filter. If you follow the traces on the board, the coax connection from the fiber transceiver is going into the low pass filter port and the common port is attached to the outgoing coax to the house.

In the center of the board is an Infineon VOIP processor, a PEF 3332. Next to that is an Altera max II CPLD listed as a epm240t100c5n; nice, something I've actually heard of before!

Finally there are a couple smaller chips scattered around, a couple of infineon dc/dc converters and a few more voltage references.

The bottom right corner of the board has the ethernet magnetics, HX5008NL.