Icron USB 2.0 Ranger® 2324 Teardown

I bought an Icron USB fiber optic extender, and had a look inside.

Thoughts

The Icron 2324 is a USB 2.0 4 port 480 Mbit⁄s extender using multimode fibers (duplex LC). I bought it (used) to extend USB ports between the main workstation and the radio rack, mainly for RFI reasons.

In my limited testing so far with a 10 meter link (Using an Airspy HF+) it works really well with no configuration or setup to use. It's basically transparent to the PC.

Teardown

I opened the LEX first:

Before opening I removed the SFP module, it is an Avago AFBR-5710PZ 1000Base-SX transceiver. I tested using some bidirectional single mode transceivers but it seemed to reject these, assuming it's similar to the USB 3.0 types it might require DDM to accept a module.

Update: Not sure why I didn't have success initially, but in 2024 I've retested using the same "JT-COM BiDi SFP 1.25G 1310 5km SM/SC DDM" (and the associated paired module) and it's completely fine. I suspect DDM is a requirement, and these modules do have that.

Most of the fun is inside the custom device labeled iTC2051C-C8, this is probably an FPGA or an ASIC made from an FPGA base. It's likely that this chip contains their "magic sauce" to make USB work over 500 meters of cable when it was designed for 5 meters.

Next to it there's a Winbond 25⨉40 flash chip which probably contains things like serial numbers and other factory settings.

The chip between the ASIC and the SFP module is a TI TLK1221, quoting from the data sheet:

The TLK1221 performs the data serialization, deserialization, and clock extraction functions for a physical layer interface device. The transceiver operates at 1.25 Gbps (typical), providing up to 1 Gbps of data bandwidth over a copper or optical media interface.

It's surprising to see this chip in a mass market product, most FPGAs can perform these tasks internally. My best guess is that they use the same ASIC in their Cat6 based extenders and replace the SERDES as needed (e.g. they might use an ethernet PHY with (R)GMII to the ASIC in the Cat6 extenders). 

Highly observant readers may have noticed that there are some components not mounted in the LEX PCB, these are used in the REX.

The primary difference on the top is that they added a power input (the REX uses 24 V/1 A, 2.1 mm center positive plug).

It's worth noting the unpopulated 20 pin header J7, this looks like it might be a standard JTAG port for development. I made no attempt to check if this was the case, but could be interesting for hackers.

There is also an additional chip installed on the bottom layer:

This extra chip is as expected a USB hub, Cypress CYUSB3314-8.

Unexpectedly it's a USB 3.0 hub:

HX3 is a family of USB 3.0 hub controllers compliant with the USB 3.0 specification revision 1.0. HX3 supports SuperSpeed (SS), Hi-Speed (HS), Full-Speed (FS), and Low-Speed (LS) on all the ports. It has integrated termination, pull-up, and pull-down resistors, and supports configuration options through pin-straps to reduce the overall BOM of the system

This seems strange. They do make a USB 3.0 extender with a fiber interface, but that device is a 2 port unit.

Assuming the 3.0 extender uses a ~10 Gbit⁄s SERDES they may use the 4-port 3.0 hub with only two ports broken out due to bandwidth limitations (5 Gbit⁄s per port for USB 3.0).

Other Notes

There is a 3.5 mm jack on the back marked "Config" and a button marked "Mode", this is called out as being reserved for the manufacturers use. Another note instructs users with certains issues to contact support for instructions on how to re-flash the firmware.

My guess is this button selects a serial bootloader that can be used to update config or flash entirely new firmware via the Config port.

The REX will power on and work with e.g. 14 V in instead of 24 V, there is a potential for exceeding the input current rating if all ports are in use however so be careful.