Nokia Siemens Flexi 3x90W FXEB 1800MHz base station teardown

[Mads Barnkob]

Teardown of a Nokia Siemens Networks Flexi Multiradio base station. This have been in service as a 3 antenna system for mobile telecommunications.

GSM/EDGE, WCDMA/HSPA and LTE capable. 3x90 Watt output power.

/>
Flexi RF Module Triple (FXxx)

The Flexi Multiradio Radio Frequency Module (FXxx) or RF Module, is a 3-branch multicarrier,multi-standard radio transceiver module. The module consists of three independent branches, capable of transmitting and receiving signals of multiple radio technologies concurrently:

    Up to 6 GSM carriers with 400 KHz minimum carrier separation
    Up to 4 WCDMA carriers with 4.6 MHz minimum carrier separation
    Multi-carrier LTE signal with 1.4 MHz, 3 MHz, 5 MHz, 10 MHz, 15 MHz, 20 MHz, and 35 MHz carrier bandwidth
    Multi RAT operation with combination of GSM, WCDMA, and LTE

The RF Modules FXDA, FXDJ, FXEA, FXCA, and FXFA/ FXFB are referred to as 70W RF Module variants. RF Modules FXEB and FXDB are referred to as 90 W RF Module variants. Each branch consists of a transmitter and two receiver chains. FXxA and FXFB (70W) variants have front end software tunable filters (STuF). 90 W RF Module variants have fixed full band filters. FXxx is a 3U high module with an integrated, replaceable 3-fan assembly for module cooling. The supported functions are:

    Chaining up to three RF Modules with OBSAI RP3_01
    2-way receive diversity in the receiver chains
    Integrated antenna line supervision
    MHA, Antenna Hopping, EGPRS2, and VAMOS support
    Digital and control circuitry, optical interface, DC/DC power conversion, and other necessary functionalities
    Integrated DC line OVP, Class II rated to 5kA pulse (FXFB, FXDB/FXEB)
    Remote Electrical Tilt (RET) support (FXFB, FXDB/FXEB)

Flexi Multiradio BTS GSM/EDGE modules are equipped with an integrated air guide plate providing full thermal compliance without casings. This allows installation of the modules without casings in Flexi cabinets and enclosed 19″ racks. Casings and covers are recommended in standalone 19″ racks (no cabinet) for safety reasons. Casings are not part of the FXxx delivery package. If the configuration requires casings, Flexi BTS Module Casing (EMHA) kits must be ordered.

The Flexi Multiradio RF Module variants are:
Version    Description
FXDA     GSM 900 (E-GSM) 70W
FXDJ     GSM 900 J-Band (P-GSM for CDMA co-siting) 70W
FXEA     GSM 1800 70W
FXCA     GSM 850 70W
FXFA/FXFB GSM 1900 70W
FXDB     GSM 900 (E-GSM) 90W
FXEB     GSM 1800 90W

[ElectroXa]

interesting ! 
I love the way RF electronics are constructed and trying to understand how it works
Thanks for the video

Did you save any RF components ?

[Mads Barnkob]

interesting ! 
I love the way RF electronics are constructed and trying to understand how it works
Thanks for the video

Did you save any RF components ?

Your most welcome

I saved the small BNC wires you saw me remove, some connectors and 6 power amplifier boards.

[Cherenkov11]

Wow! 

Just a questions, where do you get all of that RF equipment? Is it part of your job? Are they defective, or just out of service?

Regards

[Mads Barnkob]

Wow! 

Just a questions, where do you get all of that RF equipment? Is it part of your job? Are they defective, or just out of service?

Regards

I find it as scrap metal, it is sold off for its large quantity of aluminium and gold plated electronics. It is not a part of my job and I am pretty sure they are just taken down due to upgrades. Even though these LTE (4G) capable amplifiers could be used for 4G instead of the 3G they were running, its not a viable option as they need to combine their amplifier outputs for 4G, so a single amplifier can no longer run a 3 zone antenna, so its cheaper to just throw them out and buy a new 4G/5G amplifier that can work with 3 zones.

[Mads Barnkob]

/>
The high resolution pictures and circuit explanation in text are hosted on my website: http://kaizerpowerelectronics.dk/teardown/nokia-siemens-flexi-3x90w-fxeb-1800mhz-base-station-teardown-power-amplifier-part-2-of-2/

[Da_Stier]

So as Mads mentioned in part two of the teardown, I had the chance to take a look at the amplifier modules.
I started to reverse engineer the modules, however it is still kind of a work in progress.

The pinout of the amplifier seemed quite strait forward and surprised me at first since there are only seven pins visible with 4 being VCC and GND.
After some searching for datasheets I found what each IC is and therefore, how the pinout works.



The I2C Interface is only used to read the LM75A temperature sensor on the board.
(Interestingly the LM75A is made by Texas Instruments and therefore marked with T00A and not by NXP like most LM75A's are.)

The PA_EN line is connected to the base of some N Channel Transistor, might be a NPN or a NFET type, I'm not sure yet.
However by driving PA_EN high, the N Channel device drives a P Channel device, which connects the gate bias voltage to the FET's.

The second IC on the board is an AD5259 I2C controlled digital potentiometer.
The I2C interface is not externally available, only on some testpoints.
Since the AD5259 is non volatile and saves the set value, it must be used to set the gate bias voltage at the factory.

Knowing the pinout I could go ahead and actually use the module.
Before I could do anything useful however, I had to manufacture some SMP-MAX to SMA cables.
Luckily I had some of the board to board connectors from the original base station amplifier.
It turns out, that the center conductor of RG405 semi rigid coax fits snougly inside the center pin.
The outer braid was soldered directly to the body of the connector.



With the cabeling taken care of I could go ahead and actually measure the S12 parameter which I was the most interested in.



To my suprise the amplifier actually has over 400MHz of bandwith, from 1653MHz to 2059MHz.
This is rather interesting, since the LDMOS transistors are specified from 1800MHz to 2000MHz.

To measure the rather high output power of the amplifier without blowing up my VNA, I used a -40dBm directional coupler in conjunction with a 650W dummy load.




I hope I could give a first impression of the construction and performance of the amplifier modules.
I will continue to reverse engineer them a bit more and report back, as soon as I found something interesting.

[Da_Stier]

Just a quick update, i didn't have any time left for reverse engineering, however I came across this interesting application note from Ampleon (the manufacturer of the LDMOS transistors) that covers the biasing of their LDMOS devices.

Ampleon gate biasing.pdf

They actually use the temerature dependence of the pn junction of a standard small signal npn bjt to compensate for thermal runaway of the LDMOS devices.



Note how the circuit is quite similar to what I think is implemented on the amplifier modules (need further investigation though).
I think the variable resistor R5 is implemented with the AD5259 digital potentiometer.

[Da_Stier]

So for the last few days I was sick and therefore had some time to reverse engineer the amplifiers some more.

I started to do a component level reverse engineering of the biasing circuits.
After some tracing work using my trusty multimeter, I ended up with the following diagram for the biasing circuit of the MW7IC2040N preamp.





Since I could not find any useful information on the sot23 packages, I desoldered one of each type and used my component tester to find out, what they are.
This process looked something like this.



After some cleanup I came up with a quite simple circuit diagram for the biasing.
I drew it all up in LTSpice to see if a simulation would give the same results as the real boards.



At this point I realized that my power supply isn't really up to the task of supplying enough current at 28V, so I got myself a proper 28V 1200W mobile communications power supply from Ericsson.
(Which you can currently buy on ebay for 31 Euro, which I find a pretty good deal)
With this sorted out I could do some measurements and they luckily matched up with the simulation.

Next I did the power supply circuit for the LM75A temperature sensor.






Nextup will be the reverse engineering of the bias circuitry of the LDMOS devices.
Which I expect to be pretty interesting.

[Da_Stier]

Just a quick addition.
Here is a plot of the simulation output for the MW7IC2040n bias circuit.



The green line is the PA_EN line.
(The amp gets enabled right in the middle of the plot)

The red line is gate voltage 2 wich is 0V in the offstate and gets to 2.88V when the amp is enabled.
The pink line is gate voltage 1 which interestingly is always at 2.95V, no matter if the amp is on or off.

These results match up with the voltages measured on the real amp module.

[Da_Stier]

So yet another quick update.

Since the amplifier modules have no feedback in the RF path, there is nothing limiting the output power except the saturation of the active devices.
So I decided  to try how much power I can get out of one module.
Therefore it came in quite handy to have the new 1200W power supply.

By providing the input with +11dBm at 1800MHz, I could get an amplification of +42dBm.
Since the only spectrum analyzer I have that covers this frequency is made in 1970 and has no cursor functions, I have to be creative for measurements.
I start by feeding my known input power of +11dBm through my directional coupler setup and save the amplitude as reference waveform.
Then I can count up to the amplified waveform relative to the input signal.



The absolute outputpower of the amplifier is somewhere between +52 dBm and +53dBm, which makes betwwen 150W and 199W.
Since the datasheet of the LDMOS devices states a power of 200W, I think that +53dBm is quite realistic.

At this power, my RF cabeling got blazingly hot in just seconds, as did the amplifier it self.
(I used only some RG316 cables which are not really up to the task of handling such powers at that frequency)

Another intersing detail was that the 50 Ohm termination on port 3 of the circulator got quite warm as well, which I believe comes from the not perfectly 50 Ohm impedance of the directional coupler.

[johnf]

Mads
I think you mean S21 forward power gain of the amplifier not S12 reverse power gain

[Da_Stier]

So another quick update.

I still didn't really find any time to continue the reverse engineering, however, since I destroyed the circulator of the amp I did the power tests with, I decided to try something.
I was interested in the response of only the preamp used in the modules. So I took the damaged board to the hacksaw and sawed away, what can go wrong.

This is what I ended up with.



After giving the cut off part a quick clean up with the mill and some sandpaper it looked nice again.



After this I could measure its S21 response. The results were mostly as expected.
The gain is around 30 something dB.



I really like this small module since it is able to produce around 10 Watt of output power without getting to hot.