Author Topic: Alcatel Lucent B4 RRH2x60-4R teardown and reverse engineering  (Read 1099 times)

Offline Da_Stier

  • High Voltage Experimenter
  • **
  • Posts: 82
  • Karma: +4/-0
    • View Profile
Alcatel Lucent B4 RRH2x60-4R teardown and reverse engineering
« on: December 23, 2020, 02:38:43 PM »
Hi all,

a few weeks ago, I came across an Alcatel Lucent B4 RRH2x60-4R Remote radio unit on ebay. It sparked my interest, since it was made by Alcatel Lucent, instead of Ericsson, who made most of the units I have seen.
Furthermore it has a really interesting formfactor (93x28x15cm) which makes it look more like an antenna panel than an RRU.
It was also relatively cheap, since most used RRUs still go for 400 to 2000$ on ebay, which is quite hillarious.
It was listed as new but damaged during transportation. It's quite insane if you think about it, a multi thousand dollar radio unit, scrapped because someone dropped it during transport.  :o

So for fun I looked up the FCC ID and to my surprise there were actually some internal photos available.
(The internal photos required for a FCC report are set as confidential on most units I searched)
What I could see on the photos matched with the only other Alcatel unit I have ever seen. They seem to like standard parts and modules and have a lot of manual wiring and assembly work on their units.

Another thing worth mentioning is, how straigt forward the partnumber is.
B4      -> LTE band 4
RRH    -> remote radio head
2x60   -> two transmitters with up to 60W each
4R      -> four receiving channels

So after receiving quite some additional discount from the seller, my curiousity won and I bought it.

This is the unit as received:














Overview of the unit and splitting it up in two halves.



Duplexer and RX signal  conditioning assembly



Mainboard of the unit



Powersupply




One of the two RF poweramplifiers.


So my suspicion, that it might be a very modular unit with lots of cabeling and standard parts, was right.
They use MCX and SMA connectors for RF connections and standalone DCDC converter modules for most power rails.
It was quite a pain to figure out how it all comes apart, since you have to open the little "door" on the back to be able to disconnect some cables to enable the two halves of the unit to come apart.

I will document, analyze and reverse engineer every block of the unit in upcoming posts, as soon as I'm done with it.



Greetings,
Michael

Offline Da_Stier

  • High Voltage Experimenter
  • **
  • Posts: 82
  • Karma: +4/-0
    • View Profile
Re: Alcatel Lucent B4 RRH2x60-4R teardown and reverse engineering
« Reply #1 on: December 30, 2020, 07:24:25 PM »
Hi all,

I have the first update on the unit. In this update I will take a closer look at the duplexer assembly.
The duplexer has four connections to the outside world, two combined RX/TX and two RX only ports.
The PCB that does all the signal conditioning is directly mounted onto the duplexer unit.

The complete duplexer unit:


After removing the RF shield of the PCB, you can see the four LNAs (low noise amplifiers), two PMUs (Power measurement unit) and two SBUs (not sure on those yet, but has to do something with the bias tee on the TX port).


The PCB also conatins the output protection circuitry for the AISG (Antenna interface standards group, this controls the electric tilt servos on the antenna panels), the ANT interface (not totally sure on that one either) and the external alarms connector. This protection circuitry contains some TVS diodes (rather beefy SMC ones) and pretty interesting looking rectangular gas discharge tubes).

After removing the PCB, you can see, that the duplexer itself is double sided, with the four RX filters on one side and the two TX paths on the other side.



The RX filters are pretty straight forward.
There are two varieties of filters, one with a single crosscoupling link and one with two of them.




The lids are pretty standard too, with some metal tuning slugs.


The TX side on the other hand is pretty interesting.



It contains some intersting elements, which are made of ferrite slugs, that are electrically insulated from the housing.
The tunable part is a fiberglass disk that is mounted on the lid.



I was curious to see the exact shape of the ferrite slugs so I took one out (which was quite a struggle since the nylon screws are glued in place).
To my surprise I found the ferrites to be a solid cylinder, I expected them to be hollow.
They were mounted on some ceramic spacers and fixed in height.
Also noteworthy are the pentagram shaped cutmarks, which enable the blackmagic powers of the duplexer.  ;)


The connectors of the duplexer to the rest of the system were some really interesting press fit nylon things and SMA connectors for the TX input from the power amplifiers.


Since the connection to the duplexer turned out to be quite tricky, I unfortunately couldn't really measure the S21 response of the unit.

The PCB on the other hand was really nice to reuse, since it only has components on one side.
Also the individual functional blocks are layed out seperated from each other with nice silkscreen markings.
Since I need some LNA's for another project, I started to take a look at those. (That's also the reason why I start with the duplexer)
The IC's are marked "34Q" and I couldn't find any datasheets or information on them.
However I expected them to be pretty wiedband or atleast usable in all celluar bands, since all the bandwith limiting is done by the cavity filter of the duplexer anyway.

Next I chopped the PCB up into pieces that can be reused.


To test the LNA's, I again milled a quick enclosure for it.



The S21 response was pretty wide, as expected.
The gain isn't quite flat across the frequency, however it is pretty usable from 800MHz to 3GHz.
At 1.72GHz, where I want to use it, it has 17dB of gain.


Since this little LNA turned out to be pretty useful, I went ahead and made three more of them, because why not I guess.  :)


In the next post, I will propably take a look at the ADL5902 power detector IC's of the PMU's.



Greetings,
Michael

Offline Mads Barnkob

  • Administrator
  • High Voltage Expert
  • *****
  • Posts: 1659
  • Karma: +33/-0
  • Denmark
    • View Profile
    • Kaizer Power Electronics
Re: Alcatel Lucent B4 RRH2x60-4R teardown and reverse engineering
« Reply #2 on: January 03, 2021, 08:52:41 PM »
Thank you for sharing this interesting piece of base station amplifier!

For a LTE capable amplifier, it really strikes me how old school it is constructed. Many smaller PCBs, hard line tube coax instead of flexible, bolted in place, huge cabinet for the moderate 2x 60W output power.

Also noteworthy are the pentagram shaped cutmarks, which enable the blackmagic powers of the duplexer.  ;)

 ;D
https://kaizerpowerelectronics.dk - Tesla coils, high voltage, pulse power, audio and general electronics
https://www.youtube.com/KaizerPowerElectronicsDk60/join - Please consider supporting the forum, websites and youtube channel!

Offline Da_Stier

  • High Voltage Experimenter
  • **
  • Posts: 82
  • Karma: +4/-0
    • View Profile
Re: Alcatel Lucent B4 RRH2x60-4R teardown and reverse engineering
« Reply #3 on: January 04, 2021, 01:25:07 PM »
For a LTE capable amplifier, it really strikes me how old school it is constructed. Many smaller PCBs, hard line tube coax instead of flexible, bolted in place, huge cabinet for the moderate 2x 60W output power.

I was wondering that too, it seems pretty overbuilt in some places and pretty prototypish in others.
After quite a bit of google searching, I found tons of "APPLICATION FOR WIRELESS COMMUNICATIONS
SITE COORDINATION" from all over america. (The form required if you want to build a new cell site), so it seems like the type of unit was atleast somewhat common.
I also came across a Kathrein catalog that recommends this exact unit for their LTE antennas.

Right now I'm starting to think, that the unit might be overbuilt by purpose, maybe to be certified for use in critical backbone networks or something. (I'm not sure if there is such a certification, just a guess  ;) )



Here are some more pictures of some interesting construction, since it feels weird to post something without pictures.

The hardline coax feels just insanely overkill and expensive to manufacture.



Even the monitor outputs use SMA to QMA adapters, instead of simple crimp on connectors.


I like the MCX connectors with the two mounting screws, however SMA or some other screw on connectors seems easier to me.




Greetings,
Michael

Offline Da_Stier

  • High Voltage Experimenter
  • **
  • Posts: 82
  • Karma: +4/-0
    • View Profile
Re: Alcatel Lucent B4 RRH2x60-4R teardown and reverse engineering
« Reply #4 on: January 09, 2021, 05:12:53 PM »
Hi all,

today I will take a closer look at the PMUs (Power measurement units).
The Duplexer had two of these units, with two ADL5902 Power detectors each.
The ADL5902 is a pretty capable detector, which works from 50MHz to 9GHz with 65dB of dynamic range.
The output is an analog voltage with a 53mV/dB scaling.
* ADL5902.pdf
It has an ADJ input, to compensate the response to be flat across the frequency band.
If you only need a narrow frequency band, you can set this voltage by a static voltage divider, which has been done in this case.

This picture shows the basic layout of the PMU.

Each PMU has one path where the measured power is coupled through a 10dB directional coupler and one path with a 2135MHz bandpath filter and no direct output of the RF.
The filtered path is obviously used in the TX direction, since the RX signals are outisde of the filters passband.
Since the RX sensitivity for the RRH is given as -105dBm and the ADL5902 is only capable of around -60dBm, I guess all the power detectors are propably used in the TX path.

The four ADL5902 chips are all layed out the same, as can be seen here:


To reuse the parts, I once again cut everything up into smaller pieces.
The first thing that got reused were the 2135MHz ceramic resonator bandpass filters.
I simply soldered on some SMA connectors.



The VNA S21 response is as expected:

The center frequency is at 2135MHz.
The bandwith of the filter is 72MHz, resulting in a Q factor of 29, which is pretty nice.
Another nice thing about these filters is, that there are no parasitic responses at any other frequencies from 300kHz to 3GHz.
The 1.88dB of insertion loss might be a bit high due to my sloppy calibration for this measurement, who knows.  ;)

For the power detectors I once again milled a quick enclosure to add them to my RF lego collection.  :)


For the powersupply of the unit I used another snippet from the Duplexer board with a 5V LDO and smoothing capacitors on it.
... and of course my steel bolt attenuated feedthroughs.  ;D
The SMA connector is the RF input, the DC output is a SMB connector, since I have a lot of them and they are good for lower frequency stuff.

To test the unit I took measurements at 100MHz, 1GHz and 3GHz.


As you can see, it is linear between -60 to around 0dBm.
Since the calibration divider is set for somewhere around 1.7 and 2.2 GHz, the 3GHz measurement does have a slightly different slope.

Since this unit seems to work fine and can be used as a universal power detector block, I will propably make 3 more of them.


In the next post I will propably start with the power amplifier, which took quite a bit of low level reverse engineering, as well as some software to get it running.





Greetings,
Michael

Offline Da_Stier

  • High Voltage Experimenter
  • **
  • Posts: 82
  • Karma: +4/-0
    • View Profile
Re: Alcatel Lucent B4 RRH2x60-4R teardown and reverse engineering
« Reply #5 on: January 11, 2021, 01:47:57 PM »
Hi all,

this will be the first post, looking closer at the power amplifier modules.
To fully cover the modules will porpably take two or three posts.
In this first post I want to take a closer look at the process of reverse engineering.
Since I think it will be more interesting to look at every step and my notes, I won't tidy everything up, but instead show the raw notes taken during the reverese engineering of the amplifiers.

To start with I took a close look at the board and tried to find out what every component is, to get a rough idea of how it might work.
To do so, I take notes directly on the picture of the amplifer. (I use paint most of the time, since it is on literally every PC I come across)
The result looks something like this:




After doing this I had some first impressions of the amps.
One thing that is clear already is, that it won't be as easy as connecting power and signal to the unit.
The board uses an ADC and a DAC to set the operationg point for every component and monitor the temperature as well as the current draw.
Another thing that can already be seen is, that the amplifier uses a Doherty architecture, which can be seen by the quarter wavelength transformer in the output combiner of the final transistors.

The next step is to collect as many datasheets as possible to get a better idea of the exact function for each component.
This also helps with the later mapping out of the circuit, since it gives me the pinout for all devices.

For the actual reverse engineering of the circuit (atleast as much as necessary for using the device), I like to start with the "wanted function" of the unit.
Incase of this RF amplifer it is of course the amplification chain or in other words the RF signalpath. (pun intended  ;) ).

So the next step was to map out the RF path:



This is what I came up with.
Very interesting is the Pin diode attenuator on the input, which lets the amplifier set an attenuation of up to -40dB on the input.
(the -40dB are measured, I of course didn't know the exact value at this point)
Together with the 10dB directional coupler and the power detector, it forms an AGC loop to keep the input signal at constant amplitude.

The picture also shows what needs to be done to use the amplifier (the blue notes)
I need to figure out how to set the attenuation, how to make the power detector switch on the RF switch and how to apply the gate bias voltages to the LDMOS devices.

At this point I know what to do, so I can go ahead and map out some more circuitry.
I started with the gate bias, since I hoped that the attenuation would sort itself out later (in a closed loop AGC).
SPOILER: it didn't

For the gate bias I work from the gates backwards, since it is the easiest.
This is the rough layout of the gate bias circuitry:



Each gate has its own DAC channel.
It then is buffered by an opamp. This makes sure that the gate is driven by a somewhat low impedance.
Another interesting addition is the npn pulldown transistor, which can cut the bias voltage in half.
This can be used as an enable line, to save power, when the amplifier doesn't need to be biased.
The transistor is driven from the output of one element of an hex inverter IC.
All the inputs of the inverters are tied together and connected to a pin on the flat cable connector used for the control signals to the amplifier. This pin is pulled high normally, so that you need to pull down the pin to enable the bias.

Also noteworthy is the quarter wavelength transmission line on each gate. This is used to block the RF signal from the DC path.

The next step was to figure out how the attenuator on the input works.
This is what I came up with:



The attenuation of the pin diode bridge is directly proportional to the current flowing through them.
The current is set by a voltage applied through a 330 Ohm resistor.
The output driver is an opamp with a +15V supply rail and a gain of 1.5.
The input for this opamp is driven from another opamp with a gain of 5.59 through a divide by two voltage divider.
This gives a total gain from the DAC to the attenuator of 3.43.
To set the gain to the minimum value of close to 0dB, the DAC can be set to greater than 1.42 which will give around 5V at the attenuator.
(Again, this was measured later but I think it makes sense to add this now)

The next bit of circuitry to figure out was the power detector and RF switch situation.
The detector is a LTC5564, which is good up to 15GHz, what I found rather surprising.
It has an built in comparator with an external negative input.



This input is once again connected to the DAC.
The comparator output is put through an OR gate with a capacitve hysteresis, propably to make sure there is no osciallation.
The output of the OR gate then goes throgh a driver chip which switches the RF switch.
So to always enable the switch the comparator level just needs to be low enough.

The last step before I could try to control the amplifier was to figure out the connection on the ribbon cable.
So I once again mapped out the connections:



For anyone wondering, these notes are the second stage, the first stage is more chaotic and looks something like this:



So the next steps at this point were the following:
- write software to control the DAC
- pull the CS for the ADC low to disable it
- pull the PA enable low to switch on the gate bias voltage
- set the bias current for each transistor
- set the attenuation to 0dB
- set the comparator level low enough that the RF switch is on

The last little hardware step before writing software was to find a way of connecting to the ribbon cable.
I didn't want to cut up the mainboard just yet and I didn't want to solder directly to the amplifier board.
So I came up with this:



This way I can access all 12 pins of the ribbon cable on a breadboard, making it very easy to connect up an arduino.



Offline Da_Stier

  • High Voltage Experimenter
  • **
  • Posts: 82
  • Karma: +4/-0
    • View Profile
Re: Alcatel Lucent B4 RRH2x60-4R teardown and reverse engineering
« Reply #6 on: January 11, 2021, 02:02:26 PM »
I split up the previous post into two, since it became kind of long and I lost the overview.

However to set the DAC, I looked into its datasheet first.
Each control word consists of 16 bit.
The first bit is the control bit, that decides if you want to set DAC options or write the DAC values.
To write the output it needs to be set to 0.
The next 3 bit determine which channel you want to set.
It's a simple binary counter that counts the channels from A to H

A -> 000
B -> 001
C -> 010
D -> 011
E -> 100
F -> 101
G -> 110
H -> 111

The last 12 bit are the value you want to set the channel to.

The interface is a serial interface described as "SPI compatible".
This is the timing diagram for sending data:



First the SYNC line needs to be pulled low as a kind of chipselect.
Next the data can be clocked into the data shift register.
The data is latched by the LDAC line.
Since this line is pulled to GND on the amplifier, the data is loaded transparently into the DAC.
The transaction is ended by pulling the SYNC back high.

At first I tried to use the SPI interface of an arduino nano to control the DAC.
However I'm pretty bad at this kind of stuff and couldn't get it running.
But I am kind of familiar with very low level stuff (motly VHDL), so I decided to just build it from scratch.
I stayed with the arduino nano since I already had it.
Since the DAC is set via a shift register there is no real minimum timing, meaning I can set it as slow as I want.

This is the code I came up with:

Code: [Select]



// define pins used
// DAC interface
int SCLK = 13;
int SYNC = 10;
int DIN  = 11;
// other pins
int button = 5;
int LED_pin = 3;


// global variables
int clk_counter = 0;
int clk_counter_start = 32;
int CLK_value = 0;


//------------------------------------------------------------------
void setup()
{
    // start serial interface
    Serial.begin(9600);
   
    // define pin direction
    pinMode(SCLK, OUTPUT);   
    pinMode(SYNC, OUTPUT);
    pinMode(DIN, OUTPUT);
    pinMode(button, INPUT_PULLUP);
    pinMode(LED_pin, OUTPUT);

    // define standard value for each pin
    digitalWrite(SCLK, LOW);
    digitalWrite(SYNC, HIGH);
    digitalWrite(DIN, LOW);
    digitalWrite(LED_pin, LOW);
}
//------------------------------------------------------------------





//------------------------------------------------------------------
void loop()
{
    // reset the clock counter
    clk_counter = clk_counter_start;

   
    // write a word each time the button is pressed
    if(digitalRead(button) == LOW)
    {
      // switch on LED to show it is doing something
      digitalWrite(LED_pin, HIGH);
     
      // set the preamp bias
      // 1.95V for 328mA bias current
      word_write(1.95, 'F');

      // set the right final
      // 2.60V for 540mA bias current
      word_write(2.4, 'H');

      // set the left final
      // 2.63V for 540mA bias current
      // 2.67V for 1400mA bias current (datasheet 1500mA)
      word_write(2.63, 'G');

      // set the comparator level for the RF switch
      // don't know yet what makes sense, use 0.1V to try
      word_write(0, 'B');

      // set the attenuation for the Pin diode attenuator
      // 0V equals around -40dB, 1.46V equals around 0dB
      // this voltage is multiplied by 3.43 by the circuit
      word_write(0, 'D');



      // switch off the LED to show it is finished
      digitalWrite(LED_pin, LOW);
    }

    delay(2000);
}
//------------------------------------------------------------------





//------------------------------------------------------------------
void word_write(float voltage, char channel)
{
    // local variables for function
    bool current_bit = 0;
    long mask = 0b1000000000000000;
    int address = 0;
    long data = 0;
    long value = 0;
    int control = 0;

    // calculate the 12 bit binary value of the DAC for a given voltage
    value =  long (4095 * voltage / 5);
    // print calculated value on serial terminal for debugging
    Serial.print("DAC value for ");
    Serial.print(voltage);
    Serial.print("V is: ");
    Serial.println(value);

    // set the 3 DAC channel address bits by decoding the given channel letter
    switch(channel)
    {
      case 'A':
        address = 0b000;
      break;

      case 'B':
        address = 0b001;
      break;

      case 'C':
        address = 0b010;
      break;

      case 'D':
        address = 0b011;
      break;

      case 'E':
        address = 0b100;
      break;

      case 'F':
        address = 0b101;
      break;

      case 'G':
        address = 0b110;
      break;

      case 'H':
        address = 0b111;
      break;
    }


    // build the 16 bit data word bit by bit
    data = control;
    data = data << 15;
    Serial.print("only control bit:  ");
    Serial.println(data, BIN);
    data = data + (address << 12);
    Serial.print("address added:     ");
    Serial.println(data, BIN);
    data = data + value;
    Serial.print("12 bit data added: ");
    Serial.println(data, BIN);





    // set SYNC low to enable open the register
    digitalWrite(SYNC, LOW);

    // generate the clock signal
    while(clk_counter > 0)
    {
       // toggle the clock on each cycle
       if(CLK_value == 1)
       {
          CLK_value = 0;
       }
       else
       {
          CLK_value = 1;
       }
       // write the clock output
       digitalWrite(SCLK, CLK_value);
       delay(10);

      // isolate the current data bit to be sent
      if(clk_counter % 2 == 0)
      {
         // map out the current bit
         current_bit = data & mask;

         // put the current bit on the output pin
         digitalWrite(DIN, current_bit);
         
         // divide the mask value by 2 (shift mask to the right)
         mask = mask / 2;
      }

       // decrease the clock counter by one
       clk_counter --;
       Serial.println(clk_counter);
    }

    // set SYNC high to end the transaction
    digitalWrite(SYNC, HIGH);

    // reset the clock counter
    clk_counter = clk_counter_start;
}
//------------------------------------------------------------------


The "word_write" function starts by converting the given analog voltage to a 12 bit value.
Next it decodes the given channel letter to the address bits.
After this it builds the 16 bit data string by shifting the 3 components into a single variable.
The sending part toggles the clk pin using a while loop.
In each cycle the data string gets masked by a mask and the current bit gets mapped to the output pin.
The mask gets divided by two (shifted one bit to the right) after each cyle to get the next bit.

With this done, I now could control the output voltages for each DAC channel.

The next post will contain the actual measurement of the amplifier, now that all the reverse engineering has been done.





Greetings,
Michael

Offline Da_Stier

  • High Voltage Experimenter
  • **
  • Posts: 82
  • Karma: +4/-0
    • View Profile
Re: Alcatel Lucent B4 RRH2x60-4R teardown and reverse engineering
« Reply #7 on: January 13, 2021, 10:29:32 AM »
Hi all,

today I want to take a look at the actual performance of the amplifiers.
But before starting with this, I wanted to add a few random things to the previous post.

One thing I didn't mention is the actual type of DAC used in the amplifier.
It is an Analog devices AD5328. It's a 8 channel 12bit DAC with direct voltage outputs.
* AD5308_5318_5328.pdf

Another thing I wanted to add is that I'm obviously not completely done with reverse engineering.
If I want to use the amplifier for any longer than a few minutes, I definatly need to be able to read the ADC (a TLV1548) to get the temperature and the current flowing.
* tlv1548-ep.pdf
For just some quick measurements and experiments however, it is enough to be able to set the bias voltages.

And the last addition I want to make is the power supply of the amplifier.
The amp has two supply rails, provided through two screw terminal things.
It needs 5.6V for the logic and MMICs, as well as 29V for the LDMOS devices.
I'm wondering why they didn't include a small buck converter or LDO for the 5V supply, since it requires a maximum of 400mA.
Maybe they didn't want to sqeeze one in.  ???



Also note how there is a typo on the silkscreen on the 5.6V terminal.



Now for the actual measurements.
To start with I supplied the RF input with 2130MHz at -40dBm.
I then measured after the RF switch with a spectrum analyzer.
By setting the threshold value of the comparator in the power detector low enough, I was able to get the switch to be always enabled.
By changing the bias point of the pin diode attenuator, I was then able to attenuate the signal up to 40dB.

For the next measurement, I set the attenuator to the minimum attenuation of around 0.2dB and enabled the switch.
After enabeling the gate bias, I was getting around 20dB of gain out of the amp.
This seemed pretty low to me so I was trying to see what I could do.

At this point I must have messed up either the attenuator or the RF switch, since the gain remained at around 21dB max. and the most power I could get was around 31dBm or 1.3W.

To continue I used a coaxial jumper to bridge out the attenuator and switch all together and measure only the amplifier chain.



After this modification I was very surprised to see, that the gain is now at 60dB which is quite insane.
I expected around 40dB like on any other cellular RF amp I ever measured.
This is the S21 response of the main RF path:



I also took a measurement of the monitor output.
Since there are 30dB of coupling and 10dB of attenuation in this path, I expect the response to be basically the same but 40dB down.
This is exactly what it turned out to be:



For the next test I wanted to see how much power it can produce.
The final transistors are advertised as 50W average, which surprised me, since most manufactures give the maximum CW power, which is of course way more than the average of a 20MHz LTE carrier.
* AFT21S230S_232S.pdf

To do the maximum power measurement, I connected the output into a 675W 50 Ohm termination through a 40dB directional coupler (capable of safely handling 1kW).
This coupled output goes to my spectrum analyzer.
I also connected the monitor output of the amplifier to my HP powermeter to get a second opinion on the output amplitude.
By setting the input power to -8.5dBm I got 367W of output power, which was about the saturation point of the amp.
The spectrum analyzer and the powermeter perfectly agreed on that number.
At this output, the amp took 27A at 27V, which turns out to be 729W.
This turns out to be pretty much spot on 50% of efficiency, which isn't perfect for a doherty architecture but it certainly isn't terrible either, especially since I didn't experiment with the bias points at all and just took what I thought might be good.
(340mA bias current for the preamp, 550mA bias current for the class AB final and 10mA bias current for the class C peaking final.)

The amplifier stayed surprisingly cool for this amount of power.
Of course it got hot and definatly can't be used without a heatsink for long but still it wasn't as bad as expected.
The heat also spreaded quite nice and uniform across the whole amplifier.
I guess this is why they chose to use such an enormous 5mm copper coated aluminium baseplate.



--------------------------------------------------------------------------------------------------------------------------------------------------------
At this point it might be a good idea to add a small warning.
At this power, RF energy isn't quite harmless.
Make sure to have a shielding lid over the amplifier, since you can get RF burns from radiated power, especially if you have a mismatch on the output.
Also make sure to use components capable of the powerlevel or you might blow up your equipment.
Always use a good termination!
Otherwise you will propably get in trouble pretty quick.
And last but not least, at 367W you get around 130V on 50 Ohm which will tickle quite a bit if you touch it.
--------------------------------------------------------------------------------------------------------------------------------------------------------

I will propably take another look at the input stage (the attenuator and switch combo) on the second amplifier I have, since I want to know, what I messed up on the first one.





Greetings,
Michael



Offline Da_Stier

  • High Voltage Experimenter
  • **
  • Posts: 82
  • Karma: +4/-0
    • View Profile
Re: Alcatel Lucent B4 RRH2x60-4R teardown and reverse engineering
« Reply #8 on: January 18, 2021, 06:12:44 PM »
Hi all,

first of all a little update.
Since the last post, I went ahead and built 3 more of the power detector boxes.





Now for the main stuff.
Today I want to take a first look at the mainboard of the unit.
In this first post I go through the hardware and components used.

The board runs of a single 5V5 supply rail.
By providing 5V5 driectly, the board starts up but is trapped in a reset loop.
To get it running completely, it needs to be connected to the actual power supply board.
I guess there is some power good signal on the flatflex cable or something.
This needs some more reverse engineering.

Here are some overview pictures of the components:
The unit used 3 LMZ31520 DCDC  converters for generating 3V3, 1V8 and 1V.
These chips include basically everything you need for a DCDC converter, which is quite convinient.



The main FPGA is a Xilinx Kintex-7. There also is a IMX28 MCU, propably used for the user interface and alarms.
There are two debug interfaces, a mini Fire wire connector, used for a RS232 connection and an Ethernet connection.
The Ethernet uses a LAN9500A USB to Ethernet bridge IC.



The baseband signals are generated by a DAC34H84 1.25GSPS, 16 bit DAC.
In the other direction, there are two ADS4245 Dual-Channel, 14-Bit, 125MSPS Ultralow-Power ADCs and one ADS4249 Dual-Channel, 14-Bit, 250-MSPS Ultralow-Power ADC.
The clocks for all components are generated by a CDCE72010 clock synthesizer and controller.

Now for the RF stuff:
Here is the TX direction:





The TX path is pretty simple, the IQ baseband signals are used to feed an TRF37 IQ modulator. The resulting RF signal is filtered and then brought to the correct amplitude by using a MMIC amplifier and a digital stepattenuator.

Here is the RX direction:







The RX direction has an optional LNA that can be switched into circuit if necessary.
After that the amplitude is amplified / attenuated to the correct level again by using a combination of amplifiers and digital stepattenuators.
The signal is then filtred and downconverted by a MAX2039E mixer.
The IF signal is then again amplified and filtered, before being digitized by the ADCs.

What I find interesting is, that the FB path which comes from the monitor port of the power amplifier, has a complete IQ demodulation path.
This enables the unit to check the quality of the IQ signals of the sent signal.
With this info, the unit can then do some predistortion and corrections to send the best signal possible.





The local oscillator signals must be generated by this portion of the board:
However I can't find any datasheets for the used parts.

 [ Invalid Attachment ]


I guess it might be interesting to try to isolate the IQ modulator and demodulator parts of the unit to build a broadband IQ transceiver.






Greetings,
Michael

Offline Da_Stier

  • High Voltage Experimenter
  • **
  • Posts: 82
  • Karma: +4/-0
    • View Profile
Re: Alcatel Lucent B4 RRH2x60-4R teardown and reverse engineering
« Reply #9 on: January 19, 2021, 06:20:10 PM »
Hi all,

another short update.
This time I took a look at the serial console of the mainboard.
The serial interface is a pretty standard 115200 baud RS232 connection, provided over a mini firewire connector.
Since I didn't have a fitting connector, I soldered onto the pins directly.

First of all, this is the output of the unit while booting up:

* startup.txt

One thing you can see from this output is, that the Linux operationg system actually runs on the IMX28 processor and not on the FPGA.
The CPU uses the popular U boot bootloader.
By stopping the autoboot, you can acutally access the bootloader directly:

* uboot.txt

The next thing I did was to take a closer look at the commands available in the serial console.
This log shows a few things I tried and played around with:

* commands.txt

One interesting thing is the networking section.
There are all ethernet interfaces listed.
One entry is called USB and has the ip address 192.168.255.1.
This is the ethernet debug connector of the unit.
I found that there is a Telnet server hosted on that port, however it is exactly the same as the serial interface, just over another interface.

One last interesting thing is that I actually managed to exit out of the application on the serial interface and become root on the acutal linux of the unit.
I'm not sure if this is an intended functionality or a bug in their software, however it seems like a pretty risky thing to enable.

Code: [Select]

[root@kmw /root]$     
[root@kmw /root]$ cd..   
[root@kmw /]$     
[root@kmw /]$ ls   
    app   dev   home  lib   opt   root  sys   usr   
    bin   etc   init  mnt   proc  sbin  tmp   var   




Greetings,
Michael



High Voltage Forum

Re: Alcatel Lucent B4 RRH2x60-4R teardown and reverse engineering
« Reply #9 on: January 19, 2021, 06:20:10 PM »

 


* Recent Topics and Posts

post Re: Etching PCBs with a SLA 3d printer
[Printed Circuit Board]
TMaxElectronics
March 05, 2021, 11:26:36 PM
post Re: Rocket engine questions
[General Chat]
plasma
March 05, 2021, 10:17:39 PM
post Re: Help for people buying the "12-48 Volt 1800/2500 Watt ZVS induction Heater"
[Electronic Circuits]
rikkitikkitavi
March 05, 2021, 08:48:19 PM
post Re: Help for people buying the "12-48 Volt 1800/2500 Watt ZVS induction Heater"
[Electronic Circuits]
davekni
March 05, 2021, 07:41:34 PM
post Re: Baxandall converter strange output
[Transformer (Ferrite Core)]
dreamth
March 05, 2021, 07:22:17 PM
post Re: Baxandall converter strange output
[Transformer (Ferrite Core)]
dreamth
March 05, 2021, 07:18:02 PM
post Re: Baxandall converter strange output
[Transformer (Ferrite Core)]
davekni
March 05, 2021, 07:12:26 PM
post Re: Project: FreakyDRSSTC MK1
[Dual Resonant Solid State Tesla coils (DRSSTC)]
davekni
March 05, 2021, 07:05:38 PM
post Simplified mutli-stage coilgun idea
[Induction Launchers, Coil Guns and Rails guns]
Scicat111
March 05, 2021, 02:48:50 PM
post Re: COHERENT transformerless 81mHz amplifier schematic ?
[Light, Lasers and Optics]
dreamth
March 05, 2021, 11:54:31 AM
post Re: COHERENT transformerless 81mHz amplifier schematic ?
[Light, Lasers and Optics]
Da_Stier
March 05, 2021, 11:32:08 AM
post Re: Project: FreakyDRSSTC MK1
[Dual Resonant Solid State Tesla coils (DRSSTC)]
GrantV
March 05, 2021, 09:55:49 AM
post Re: COHERENT transformerless 81mHz amplifier schematic ?
[Light, Lasers and Optics]
dreamth
March 05, 2021, 09:32:25 AM
post Re: Baxandall converter strange output
[Transformer (Ferrite Core)]
dreamth
March 05, 2021, 09:16:51 AM
post Re: Baxandall converter strange output
[Transformer (Ferrite Core)]
dreamth
March 05, 2021, 08:40:02 AM
post Re: Help for people buying the "12-48 Volt 1800/2500 Watt ZVS induction Heater"
[Electronic Circuits]
hightemp1
March 05, 2021, 05:54:47 AM
post Re: Help for people buying the "12-48 Volt 1800/2500 Watt ZVS induction Heater"
[Electronic Circuits]
petespaco
March 05, 2021, 05:43:13 AM
post Re: Etching PCBs with a SLA 3d printer
[Printed Circuit Board]
johnf
March 05, 2021, 05:17:46 AM
post Re: Help for people buying the "12-48 Volt 1800/2500 Watt ZVS induction Heater"
[Electronic Circuits]
hightemp1
March 05, 2021, 05:08:14 AM
post Re: COHERENT transformerless 81mHz amplifier schematic ?
[Light, Lasers and Optics]
johnf
March 05, 2021, 05:02:17 AM
post Re: Need Help w/Build - Lightning Pulse Generator
[Laboratories, Equipment and Tools]
johnf
March 05, 2021, 04:45:37 AM
post Re: Help for people buying the "12-48 Volt 1800/2500 Watt ZVS induction Heater"
[Electronic Circuits]
davekni
March 05, 2021, 04:13:43 AM
post Re: Help for people buying the "12-48 Volt 1800/2500 Watt ZVS induction Heater"
[Electronic Circuits]
hightemp1
March 05, 2021, 03:08:09 AM
post Electromechanical gadgets
[Laboratories, Equipment and Tools]
klugesmith
March 05, 2021, 02:49:06 AM
post Re: Etching PCBs with a SLA 3d printer
[Printed Circuit Board]
klugesmith
March 05, 2021, 02:29:05 AM
post Re: Baxandall converter strange output
[Transformer (Ferrite Core)]
davekni
March 05, 2021, 12:43:03 AM
post Re: DRSSTC Performs only with 1cm Arcs - Troubleshooting
[Dual Resonant Solid State Tesla coils (DRSSTC)]
davekni
March 05, 2021, 12:37:50 AM
post Re: Help for people buying the "12-48 Volt 1800/2500 Watt ZVS induction Heater"
[Electronic Circuits]
davekni
March 05, 2021, 12:22:33 AM
post Re: Failure modes of electrolytics under heavy pulse load
[Capacitor Banks]
John123
March 04, 2021, 11:32:28 PM
post Re: Resonant capacitors on Chinese ZVS drivers
[Capacitor Banks]
John123
March 04, 2021, 11:29:43 PM
post Re: Project: FreakyDRSSTC MK1
[Dual Resonant Solid State Tesla coils (DRSSTC)]
davekni
March 04, 2021, 10:18:32 PM
post Re: Baxandall converter strange output
[Transformer (Ferrite Core)]
dreamth
March 04, 2021, 09:35:40 PM
post Re: Baxandall converter strange output
[Transformer (Ferrite Core)]
Twospoons
March 04, 2021, 09:27:58 PM
post Re: Help for people buying the "12-48 Volt 1800/2500 Watt ZVS induction Heater"
[Electronic Circuits]
hightemp1
March 04, 2021, 07:58:06 PM
post Re: Resonant capacitors on Chinese ZVS drivers
[Capacitor Banks]
dreamth
March 04, 2021, 04:56:30 PM
post Re: Light, laser and optics - Link collection
[Light, Lasers and Optics]
dreamth
March 04, 2021, 04:41:06 PM
post Re: COHERENT transformerless 81mHz amplifier schematic ?
[Light, Lasers and Optics]
dreamth
March 04, 2021, 03:18:19 PM
post Re: COHERENT transformerless 81mHz amplifier schematic ?
[Light, Lasers and Optics]
Da_Stier
March 04, 2021, 02:40:56 PM
post Re: COHERENT transformerless 81mHz amplifier schematic ?
[Light, Lasers and Optics]
dreamth
March 04, 2021, 01:48:05 PM
post Re: COHERENT transformerless 81mHz amplifier schematic ?
[Light, Lasers and Optics]
Da_Stier
March 04, 2021, 01:18:44 PM
post Re: Project: FreakyDRSSTC MK1
[Dual Resonant Solid State Tesla coils (DRSSTC)]
GrantV
March 04, 2021, 11:15:01 AM
post COHERENT transformerless 81mHz amplifier schematic ?
[Light, Lasers and Optics]
dreamth
March 04, 2021, 10:42:41 AM
post Interrupter frequency?
[Dual Resonant Solid State Tesla coils (DRSSTC)]
GrantV
March 04, 2021, 10:08:39 AM
post Re: Baxandall converter strange output
[Transformer (Ferrite Core)]
dreamth
March 04, 2021, 09:34:59 AM
post Re: TIG welder teardown. ESAB TIG Caddy 1500i.
[Electronic Circuits]
Bouaziz
March 04, 2021, 09:34:05 AM
post Re: DRSSTC Performs only with 1cm Arcs - Troubleshooting
[Dual Resonant Solid State Tesla coils (DRSSTC)]
ChrisBlis
March 04, 2021, 09:30:38 AM
post Re: Baxandall converter strange output
[Transformer (Ferrite Core)]
dreamth
March 04, 2021, 09:08:55 AM
post Re: Large coil experimenting with long on-times.
[Dual Resonant Solid State Tesla coils (DRSSTC)]
fh89
March 04, 2021, 07:16:23 AM
post Re: DRSSTC Performs only with 1cm Arcs - Troubleshooting
[Dual Resonant Solid State Tesla coils (DRSSTC)]
davekni
March 04, 2021, 05:08:32 AM
post Re: Project: FreakyDRSSTC MK1
[Dual Resonant Solid State Tesla coils (DRSSTC)]
davekni
March 04, 2021, 04:47:32 AM

Sitemap 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 
SimplePortal 2.3.6 © 2008-2014, SimplePortal