Ericsson RRUS 11 B4 teardown

[Da_Stier]

Hi all,

while cleaning up I came across this Ericsson RRUS 11 B4 remote radio unit under my desk.
I thought I make a few photos while tearing it down.

This is what the datasheet from Ericsson has to say about the unit: "RRUS 11 supports WCDMA, CDMA and LTE FDD (depending on frequency band). It has two duplex RX/TX branches and supports cross connection of RX
ports with other RRUs."

B4 means it operates in the B 4 band, meaning 1710 to 1755 MHz uplink and 2110 to 2155 MHz downlink for WCDMA and LTE.
The units outputs two carrier with a max power of 10W which can be upgraded up to 2x 40W with software keys.
It weighs 21.6kg and uses up to 430W of power.

I got my unit on ebay for I believe around 80 bucks.
The plastic shield was totally smashed to pieces when I got it, however the unit itself looked brand new and I'm not sure if it was ever in use.


outside view of the unit


view of the connectors


inside view with the amplifier half removed


the amplifier half of the unit


input boards


power amplifier and shielding lid


power amplifier board


The heatsink of the power amplifier has some embedded copper heatpipes in the aluminium housing. I never came across something like this, seems pretty expensive to manufacture.




The two duplexer units are identical. They use standard QMA connectors for the I/O which makes them really useful for reusing them.
Most other duplexers I came across had some variety of SMP connectors which are a pain to find and reuse.


the input board for the -48V power supply


the input board for the data connection to the mainboard


The main FPGA of the unit


The DCDC converters of the mainboard use some PCB inductors, which I find quite neat.

201202_ericsson_remote_radio_unit_description.pdf
This is the overview of the RRUS series from Ericsson if somebody wants to take a look.

I will post some updates with measurements of the duplexer units as well as some parts of the power amplifier, as soon as I'm finished. 



Greetings,
Michael

[Da_Stier]

Sorry for doubleposting but I have the first update on the unit.
I wanted to reuse some of the PTMA210152M amplifiers, that are used as preamps in this case.

Wolfspeed_PTMA210152M_V1.pdf

According to the datasheet it can be used from 1800 up to 2200 MHz.
I hope that I can get away with a little more than that by using only part of the maximum output and maybe playing a bit with the input / output matching.

To do so I started by cutting up the big board into several pieces that I can reuse for other projects.
It always feels kind of wrong to cut up these nice boards with tinsnips 


To play with the PTMA210152M, I went outside and milled a quick enclosure for it to have a nice selfcontained unit.





I was pretty surprised to see the result of the S21 measurement for the stock amplifier on the VNA.
The bandwith was totally usable from 1500 to 2500 MHz and well within 40dB of gain.
The max. output power of this setup is right around 15W, however for cooling reasons it might be a good idea to stay within 10W.




Greetings,
Michael

[Mads Barnkob]

Very nice and straight forward unit, one of those where we can still see with the naked eye what is going on. I guess that ends with 5G amplifiers, but I have yet to see one on the inside

It still surprises me each time how many radically different base station units there are. This looks nothing like the Ericsson units I have taken apart. Every unit looks like a prototype!

I see that you got the pre-amplifier running on its own, its too complicated to get the output amplifiers running or just no reason to play with that powerful LDMOS?`

I hereby give you an virtual award for best isolated steel-bolt-attenuated power input feed connection

[Da_Stier]

I was wondering that too, for something that is so complicated I would have guessed, that they try to build modular pieces and reuse as many as possible.
But as you said, each one seems different, even two very similar units often have quite significant differences.

With pure 5G basestations, the era of huge LDMOS output drivers might be pretty much over, since the large MIMO panels will have a lot of 1 to 10W drivers only.
... however this might also mean, that it will be even cheaper to get the old ones. 

In this case I wanted a small amp with around 10W output, so I simply didn't need to get the finals working, however I kept half of the amplifier with the complete amplifier chain to get up and running on a rainy sunday.

Thanks for the award, I feel honored. 
I like to use this combination of M3 screws and TO220 isolation washers for high power feedthroughs, since they are cheap, I have a lot of them and they are easy to mount in aluminium enclosures.
And for the power levels that I need, the resistance of the steel screw isn't too much of a deal but I did use some copper screws for a bigger unit just to be safe.

[Da_Stier]

Hi all,

I got a few more updates on the RRH.
First of all a few additions to the previous posts.

I noticed, that I never added a photo of the whole logic board, so here we go:




I also notice that I missed to show a final internal view of the small 10W module I built.
I had problems with internal resonances, which meant, that the amp only produced 33dBm whith the lid closed, however it produces 40dBm just fine with the lid open.
I added a strip of 0.8mm FR4 copperclad between the preamp and the final stage and also some of the black IC antistatic foam as a makeshift RF absorber.
I also added some silpads for heat transfer, because why not.
Now it works just fine with the lid closed.



Now for the new stuff, I opened one of the duplexers to show you.








Here are some VNA plots of the filter response of the duplexer.
(These were taken after the inside view, so I had to put the million screws back in    )
For the full duplex one I recombined the RX and TX ports with an 6dB resistive coupler and 3dB fixed attenuators, so ignore the 10dB loss.





Looking at these plots, I was interested in the Q factor for each direction. For the RX direction this would be 1732MHz / (1760MHz - 1704 MHz) = 30.9
For the TX direction this would be 2131.5MHz / ( 2161MHz _ 2100MHz) = 34.9
Both Q factors are pretty incredible to me, since I noramlly work with simple LC filters with Q factors of around 5.
Also the Q factor for the TX path is higher wich is expected, since you want to get rid of as many unwanted signal as possible.


I also took a look at the LDMOS transistors used as finals in the RRH.
One is an SRF8S21171HS, the other one is an MRF8S21100HS.
They seems pretty similar so I'm not entierly sure what's the difference.
Another interesting thing is, that the outputs of the two finals are combined by a stripline coupler, while the inputs are completely independent.
For my testing I isolated the two transistors and attached some connectors to the piece of board.



These were the results of measuring S21 for path A and B:




I was surprised that the bandwith differed so much but maybe that is the difference between the two LDMOS, who knows.
For the measurements, I biased the gates, so that the transistors sit at 480mA bias current, which seemed about right, when compared to other LDMOS devices of that size.
I used a constant voltage to bias them, since I only use the transistors for a very short time to take the measurement and with a big block of Aluminium as a heatsink.

I also measured the maximum power that the devices can output. For this I used my 10W amp as a driver.
I only measred the A path, because I liked the S21 response of path A better.
I got 53.7dBm out, which is just over 230W. The amp drew 11.5A at 28V, meaning it took 322W at the input, giving it about 70% efficiency which is pretty good.


For a last experiment I took a look at the logic board.
Since it is a nice selfcontained unit with the powersupply integrated, I wanted to see if I could find the serial terminal.
Every RRH I came across had a serial terminal available. There also is a LMT connection, which stands for "local maintenance terminal", which is an actual connector on the outside of the unit, however it requires login data which I of course don't have. However most units have a second terminal that isn't brought out of the board, which doesn't require any login.
I found a RS232 transceiver and hooked up some wires to take a look.



And bingo, found the terminal connection:

Code: [Select]

Iboot version: CXC1321302/4-R3B
Board type:    AUM2HP, 64Mb FLASH, 32Mb RAM
Reset cause:   POWER-ON
Start cause:   COLD
Aboot:         NOT PRESENT
Debug mode:    DISABLED (watchdog enabled)
S-record scan: START (t=229ms), STOP (t=2203ms)
Found Lmcs:    Prio: Address:    Size:       SeqNo: Type: PID:
                #1   0xFC020000  0x005673BC  0000   BOOT  CXP901096%12-R27KB
                #2   0xFEF20000  0x0092BE14  0005   APPL  CXP9013268%6-R59FC
                #3   0xFDF20000  0x00918718  0003   APPL  CXP9013268%6-R59BE
                #4   0xFCF20000  0x00B43A6C  0000   APPL  CXP9017316%1-R39UL
Starting Lmc:  CXP901096%12-R27KB (t=7206ms), Prio:1, RestartNo:0

XPL: Entering XPL version:
XPL: CXC1321812/1-R4F
XPL: rpdout-file found
XPL: rpdout-file uncompressed OK...
XPL: .data-section copied OK...
XPL: .bss-section initialised OK...
XPL: Unpacked file OK.
XPL: rpdout-file found
XPL: rpdout-file uncompressed OK...
XPL: .data-section copied OK...
XPL: .bss-section initialised OK...
XPL: Unpacked file OK.
XPL: rpdout-file found
XPL: rpdout-file uncompressed OK...
XPL: .data-section copied OK...
XPL: .bss-section initialised OK...
XPL: Unpacked file OK.
XPL: Launching program

Shell baudrate set to 9600bps
Starting shell...

XP shell for LMC: CXP901096%12_R27KB
Welcome to OSE Shell ose5.3.
$
HW initialization completed
$
Auboot SW started

I also had a little play around and found several command lists like this:

Code: [Select]

$ help
Command         Description
                default shell command
.               execute commands from file
?               print description of commands
atf             Execute ATF command
au3vii          Print LED status for all AU3 units or the selected one (au3==AU-type).
bc              Access to BCI test interface
biosls          List installed bios modules
bl              list blocks
board           Driver Layer Test Interface
capi
ccie            CCIE shell cmd
cfheflist       Get active fault list
cfhefmap        Get fault mapping
cfpga           FPGA driver test interface
cls             clear screen (using ANSI codes)
comb             XPAI fault test commands.
connfss         connect to remote fss
cpri            Send RICR delay update indication
date            print or set/adjust date & time
db              Operations on the Radio SW Database content
dp              Start or stop the DP.
dumph           dump heap info or list all heaps
echo            echo arguments (-n no newline)
elog            Access to the event log
errno           print description of errno number
fm              Access to the RU faults
fssls           list fss objects
getpri          Show the priority of a process
gio             Access to the general IO ports
hal             HW Abstraction Layer Test Interface
help            print description of commands
hostname        show or set hostname
hwlog           Manages hardware log.
intercept       intercept process/block
keys            configure/display terminal key settings
kill            kill process/block
link            Link control.
linkstat        Print RS485 link, L2 protocol HDLC, UNC and UCC state and statistics.
linkstat2       Print CPRIi2 link, L2 protocol HDLC, UAC state and statistics.
listenv         list environment variables for <processes> and their corresponding block.
lmcdelete       Delete a loadfile
lmclist         Displays a list of loadfiles
lmlist          Displays a list of subfiles in lmc lfIx, or current lmc if lfIx is not given
loadaubootmode  Enter state where reload of AUBOOT is possible
nodeid          Manages node id.
par             Manages board parameters
poolinfo        List information about pools
ps              list processes
qs              List signals in a process signal queue
rcmd            remote command execution
readmem         Read length byte from address and print result in shell.
restart         Restarts the xp board.
resume          resume process/block
rlc             Clear the ramlog
rld             Display ramlog
rlw             Write a string to the ramlog
rtcscale        print or set RTC/hwclock scale
ru              Access to the CBC RRU Unit interface
run             Resume all intercepted processes
salparam        Sal Parameter Manager Test Interface
setenv          set/list environment variable [for block] [for process]
setpri          Change the priority of a process
shell           invoke shell
sigs            List information about signals
sleep           sleep a while
spi             SPI driver test interface
ss              Show maximum process stack usage
start           start process/block
startapp        start application <program>
stop            stop process/block
subsc           Lists all subscriptions.
te              Trace & Error Handling commands
term            display info about terminal
timezone        configure RTC with timezone data
tsh             Test Shell
uic             UIC interrupt information.
uic2            UIC2 or UIC3 interrupt information.
unsetenv        remove environment variables [from block] [from process]
uptime          display system uptime
vii             Displays current LED request. 'vii d' gives more details
warpA           Warp driver test interface
who             list who is logged on
xpp             XPP test interface

I hope some of you find some of this intersting,
Michael

[Mads Barnkob]

I missed your post due to the higher forum activity

That is some nice hardware and yet again, not even remotely the same layout as others. Did you ever find out what the inter-connect RF gold jacks was called? Did it have a name like SMA?

Its super cool that you found unrestricted serial access on the board, I never gave that a try as I just assumed it would be secured in some way

[Da_Stier]

I have a different unit from Alcatel Lucent on its way, I think you will like that one 

Most of the RF interconnects are some kind of SMP.
The bigger ones (I'm well aware that this is a pretty loose thing to say) are called SMP-Max (the ones on the nokia amps you sold me)
The ones on the RBS6000 series units are just simply called SMP.

Most of them are either made by Radiall or Amphenol, however even those two manufactures offer SMP, SMP-Max, SMPS, SMPM, SMP-COM, SMPW, etc. This makes it pretty annoying to find the correct connector for reusing the amps. That's the reason why I just change them to SMA whenever I don't get the fitting connectors with the amps.

Yeah, it's pretty interesting to see, it also offeres a lot of (very low level) debug info. However for it to be really useful, you would need to know a lot more about the architecture of the unit and the command sets used.
Schematics would propably help too, since you can even toggle single IO bits of the main FPGA.

Maybe you want to give it a try on your next teardown? 
PS: Do you have plans for when the videos of "the other unit" will be made?   

[kracken]

For a last experiment I took a look at the logic board.
Since it is a nice selfcontained unit with the powersupply integrated, I wanted to see if I could find the serial terminal.
Every RRH I came across had a serial terminal available. There also is a LMT connection, which stands for "local maintenance terminal", which is an actual connector on the outside of the unit, however it requires login data which I of course don't have. However most units have a second terminal that isn't brought out of the board, which doesn't require any login.
I found a RS232 transceiver and hooked up some wires to take a look.



And bingo, found the terminal connection:

Code: [Select]

Iboot version: CXC1321302/4-R3B
Board type:    AUM2HP, 64Mb FLASH, 32Mb RAM
Reset cause:   POWER-ON
Start cause:   COLD
Aboot:         NOT PRESENT
Debug mode:    DISABLED (watchdog enabled)
S-record scan: START (t=229ms), STOP (t=2203ms)
Found Lmcs:    Prio: Address:    Size:       SeqNo: Type: PID:
                #1   0xFC020000  0x005673BC  0000   BOOT  CXP901096%12-R27KB
                #2   0xFEF20000  0x0092BE14  0005   APPL  CXP9013268%6-R59FC
                #3   0xFDF20000  0x00918718  0003   APPL  CXP9013268%6-R59BE
                #4   0xFCF20000  0x00B43A6C  0000   APPL  CXP9017316%1-R39UL
Starting Lmc:  CXP901096%12-R27KB (t=7206ms), Prio:1, RestartNo:0

XPL: Entering XPL version:
XPL: CXC1321812/1-R4F
XPL: rpdout-file found
XPL: rpdout-file uncompressed OK...
XPL: .data-section copied OK...
XPL: .bss-section initialised OK...
XPL: Unpacked file OK.
XPL: rpdout-file found
XPL: rpdout-file uncompressed OK...
XPL: .data-section copied OK...
XPL: .bss-section initialised OK...
XPL: Unpacked file OK.
XPL: rpdout-file found
XPL: rpdout-file uncompressed OK...
XPL: .data-section copied OK...
XPL: .bss-section initialised OK...
XPL: Unpacked file OK.
XPL: Launching program

Shell baudrate set to 9600bps
Starting shell...

XP shell for LMC: CXP901096%12_R27KB
Welcome to OSE Shell ose5.3.
$
HW initialization completed
$
Auboot SW started

I also had a little play around and found several command lists like this:

Code: [Select]

$ help
Command         Description
                default shell command
.               execute commands from file
?               print description of commands
atf             Execute ATF command
au3vii          Print LED status for all AU3 units or the selected one (au3==AU-type).
bc              Access to BCI test interface
biosls          List installed bios modules
bl              list blocks
board           Driver Layer Test Interface
capi
ccie            CCIE shell cmd
cfheflist       Get active fault list
cfhefmap        Get fault mapping
cfpga           FPGA driver test interface
cls             clear screen (using ANSI codes)
comb             XPAI fault test commands.
connfss         connect to remote fss
cpri            Send RICR delay update indication
date            print or set/adjust date & time
db              Operations on the Radio SW Database content
dp              Start or stop the DP.
dumph           dump heap info or list all heaps
echo            echo arguments (-n no newline)
elog            Access to the event log
errno           print description of errno number
fm              Access to the RU faults
fssls           list fss objects
getpri          Show the priority of a process
gio             Access to the general IO ports
hal             HW Abstraction Layer Test Interface
help            print description of commands
hostname        show or set hostname
hwlog           Manages hardware log.
intercept       intercept process/block
keys            configure/display terminal key settings
kill            kill process/block
link            Link control.
linkstat        Print RS485 link, L2 protocol HDLC, UNC and UCC state and statistics.
linkstat2       Print CPRIi2 link, L2 protocol HDLC, UAC state and statistics.
listenv         list environment variables for <processes> and their corresponding block.
lmcdelete       Delete a loadfile
lmclist         Displays a list of loadfiles
lmlist          Displays a list of subfiles in lmc lfIx, or current lmc if lfIx is not given
loadaubootmode  Enter state where reload of AUBOOT is possible
nodeid          Manages node id.
par             Manages board parameters
poolinfo        List information about pools
ps              list processes
qs              List signals in a process signal queue
rcmd            remote command execution
readmem         Read length byte from address and print result in shell.
restart         Restarts the xp board.
resume          resume process/block
rlc             Clear the ramlog
rld             Display ramlog
rlw             Write a string to the ramlog
rtcscale        print or set RTC/hwclock scale
ru              Access to the CBC RRU Unit interface
run             Resume all intercepted processes
salparam        Sal Parameter Manager Test Interface
setenv          set/list environment variable [for block] [for process]
setpri          Change the priority of a process
shell           invoke shell
sigs            List information about signals
sleep           sleep a while
spi             SPI driver test interface
ss              Show maximum process stack usage
start           start process/block
startapp        start application <program>
stop            stop process/block
subsc           Lists all subscriptions.
te              Trace & Error Handling commands
term            display info about terminal
timezone        configure RTC with timezone data
tsh             Test Shell
uic             UIC interrupt information.
uic2            UIC2 or UIC3 interrupt information.
unsetenv        remove environment variables [from block] [from process]
uptime          display system uptime
vii             Displays current LED request. 'vii d' gives more details
warpA           Warp driver test interface
who             list who is logged on
xpp             XPP test interface

I hope some of you find some of this intersting,
Michael

Hey Michael,

I am curious as to what settings you used for the serial terminal access? Currently have one of these boards hooked up the same way and I am getting jumbled text with the settings below:

Baud: 9600
Data Bit: 8
Stop Bit: 1
Parity: None
Flow Control: None

I have the TX, RX, and GND of my TTL converter hooked up. The datasheet looks as though it should be pin 6 for T2OUT and pin 7 for R2IN which I have connected and I have GND connected to the the ground on the edge of the board.

*Edit* -- Just realized that the chip on my board is a little different than the one in the photo. This one shows as:
 MAX3225EE
 TP551
 +BJAL

*EDIT2* Found the issue, it needed to be a usb to serial converter instead of a TTL connection