Xfinity XB3 hardware mod: Disable WiFi and save 2 watts

xb3_disable_wifi.md

Xfinity XB3 hardware mod: Disable WiFi and save 2 watts

Background

Comcast has a prepaid "Xfinity NOW" service that's cheaper than normal Xfinity, with unlimited data instead of a 1.2TB/month cap. If you currently have Xfinity, the NOW online signup is hidden, but when I called to cancel my Xfinity service on a date a couple weeks in the future, the NOW signup started working immediately. (I initially queried a neighbor's address to confirm that NOW was available in my area.)

The catch is that you can't use your own modem. They provide a free Arris TG1682P (also known as the XB3), but it's huge and uses more power (14.9 watts) than my Arris SB8200 (9.8 watts). I suspect they retired millions of these things and treat NOW as a recycling service.

The XB3 lets you enable bridge mode via the admin page at http://10.0.0.1/, and IPv4/IPv6 works just like a plain modem, but even in bridge mode, the gateway broadcasts several hidden SSIDs with no option to disable the radios. Curiously I did not see an xfinitywifi broadcast, but your modem may vary.

The Hack

I found reversible hardware mod to disable the WiFi radios.

Refer to this disassembly video. There are 6 screws (2 hidden), lots of plastic prying, and you will probably wrinkle the rear sticker.

My circuit board is labeled TG1682/TG2472:

Notice the two shielded WiFi modules. The shields just pop off but you can leave them on. In between is an 8-pin chip labeled "54328", a TPS54328 buck regulator. My meter shows that pins 6-7 (Vout) connect to various pins on both Atheros WiFi chips. Pin 1 is EN/enable. It measures 3.3 volts, and when I connect it directly to ground, it sinks negligible current.

So that's the mod. Connect Pin 1 on the 54328 to anything grounded. I used the far side of this nearby capacitor:

The XB3's idle power consumption dropped from 14.9 watts to 12.5 watts, the WiFi lights are off, and everything else seems to work via wired ethernet. I notice that http://10.0.0.1/ is inaccessible (connection refused or HTTP 503) for a few minutes after booting, but it wakes up eventually.

Caveats

I don't actually know what circuit pulls up the EN pin, so it's possible that I'm overloading a digital output somewhere. I just measured amps to ground and saw a small number. My first idea was to lift the pin before soldering the wire, but I found that too difficult.

The XB3 uses an Intel Puma 6 chipset, which has been in the news over the years due to latency/jitter problems. So far I'm not seeing anything weird on https://gfblip.appspot.com/ or https://speed.cloudflare.com/.

Hi,

Very useful post!

Regarding the TPS54328 chip, I'm wondering if just cutting the "EN"able pin 1 short from the PCB soldering, would achieve the same objective? Or it needs to be firmly connected to ground? The Texas Instruments' data sheet states that it enables the whole circuit only on a high potential. Although it doesn't mention explicitly what happens if the pin stays NC - would that be considered Undefined Behavior (susceptible to noise)?

The reason for asking is that I don't have a soldering iron right now, and I wouldn't prefer to just buy one only for this job :-).

Thank you.

I'm wondering if just cutting the "EN"able pin 1 short from the PCB soldering, would achieve the same objective?

The datasheet doesn't say whether EN has an internal pulldown resistor, so disconnecting it might make the output unstable.

If you can only cut, then cutting the VIN pin 8 might be a better idea. Just be aware that you lack the tools to reverse the mod if needed.

Ah, yes, I was thinking about the VIN pin 8 as well, which would just cut the power off completely from the chip.

And I don't think I a need a reversible mod approach to this, since Comcast does not expect the XB3 cable modem gateways (mine is Arris TG1682P model) to be returned. As per their End User Agreement for the Internet NOW service, the customers are expected to just throw it out when service is cancelled :). And I'll never rely on an Intel wifi Puma chipset for a reliable wifi AP in my house anyway 👎).

Maybe I'll just buy a little soldering station, there is one that is thermally-controlled at Lowe's and costing less than $50.

Thank you!

This is a great resource, so I wanted to contribute in regards to this mod. My board revision was a little different, labeled TG1682_CD. The 54328 is turned 90 degrees clockwise and lives above the silk-screened circled C in copyright. But aside from location and orientation, it looks almost identical to the close up picture, with just about all components around it placed in the same fashion. It is still labeled U415, so there is no mistaking it. I cut pin 8 (VIN), and viola, same result. 2.4 and 5 GHz lights are out, no unknown broadcasts from gateway, happy camper here.

Thank you for posting this!

Like @sen7inel, my board is labeled TG1682_CD and is slightly different, but this guide still worked to disable WiFi and save a few watts. Here is a closeup of the working mod for this board:

I didn't try it, but it looks like another option would be to remove C409 and move R441 over to the C409 pads. It appears that R441 is a pull-up jumper between EN and the 3v3 rail. C409 is a smoothing capacitor between EN and GND. Removing R441 and C409 should isolate EN, and then re-installing a pull-down resistor on the C409 pads would pull EN to GND, effectively disabling it.

I'll leave another hardware mod here as well...

I really wanted this modem to be able to be powered by (external) DC instead of the AC-DC adapter that is built-in. Doing so would allow me to power it off of my large battery backup system much more efficiently with just a DC-DC step-down converter instead of having to go through a DC-AC inverter just to then step the AC back down to DC again. I also can't find a DC-AC inverter that would run directly off of my external power supply (19.5v) or external battery (4S li-ion, 16.8v-12v range), so I'd also need a step-down DC-DC prior to the inverter.

After some investigation, it appears that the onboard AC-DC adapter outputs 12v, which is then directly fed into a bunch of onboard DC-DC converters to step it down to 5v, 3.3v, 1.5v, 1.3v, 1v, etc... It looks like the DC-DC converters are rated for up to 18v (or higher), but most of the bulk capacitors are only 16v, so 15v is probably the absolute maximum that should be used. It would probably run down to 6v or so, although I didn't try that. Since my input is as high as 19.5v anyway, I'll just use a DC-DC step down set to 12v to match the existing onboard converter and try to inject that directly onto the '12v' rail.

My first attempt to inject 12v DC into the modem almost worked, but for some reason the 5v dc-dc wasn't running and I never got a link on the ethernet ports. After some investigation, it appears there is some type of 'power good' wizardry happing with some diodes and mosfets near the output of the onboard AC-DC adapter. Q702 is pulling down a signal that runs to the EN pin of the 5v regulator, and which possibly routes elsewhere. Simply removing the Q702 mosfet seems to have fixed the problem, though, and I can now successfully power this with external DC power!

With both mods, this modem now uses about 9-10W (from the input side of the DC-DC step-down, MP1584 based). Much more reasonable!

Please be careful if you try to replicate this mod, and I take no responsibility if you destroy your modem or get zapped. Probably would be best to remove the AC input connector so it can't be used accidentally.