Teardown of a IBM Blade server HS22V

Here I am doing a teardown on a IBM HS22V blade server dated back to 2010.

The IBM BladeCenter HS22V blade server supports up to two multi-core Intel Xeon microprocessors and has eighteen memory-module slots, two SSD storage-drives bays, one Horizontal-compact-form-factor (CFFh) expansion card connector, one Vertical-combination-I/O (CIOv) connector, and one internal USB connector.

Microprocessor:

  • Supports up to two multi-core Intel Xeon E/X 55/5600 series microprocessors

Memory:

  • 18 dual inline memory module (DIMM) connectors
  • Type: Very Low Profile (VLP) double-data rate (DDR3) DRAM. Supports 1 GB, 2 GB, 4 GB, 8 GB, and 16 GB DIMMs with up to 288 GB of total memory on the system board
Posted in Teardown | Tagged , , | Leave a comment

Ericsson Radio Base Station RBS3206 teardown

The RBS3206 macro is an indoor Radio Base Station with one to four carriers and one to  six sectors at 20/40 Watt RF output power per carrier.

All the boards that I have comes from the middle row in the above picture and unfortunately I did not have any of the diplexers at the top or the power supplies that are at the bottom row.

The following 24 minute video shows the teardown step by step with explanations, high resolution pictures of the boards is in the last part of the video and also further down this post.

In 1999 Ericsson had 17 test systems running around the world with WCDMA, which is better known as 3G among normal people. WCDMA stands for Wideband code-division multiple access. This RBS3206 indoor macro system is from around 2008. It also supports all these technologies GSM / EDGE, WCDMA / HSPA and LTE.

The RBS application software is distributed over several processors using the interprocessor communication offered by the platform. The main processors of the
RBS 3000 cooperate to form a main processor cluster (MPC) that executes most of the
control software. The processors that make up the MPC are equal in terms of control —
that is, there are no master-slave relationships between them. However, if one of the processors fails, the program execution is moved to another main processor in the
MPC. For control, most boards are equipped with a board processor (BP). Those units
that do not contain a board processor are monitored by other units.

The circuit analysis was made rather difficult from all the custom marked Ericsson parts and other ICs where it is not possible to locate a datasheet.

The main CPU is a Ericsson “AUC” with part number ROP 101 1190/2 which has 128MB ISSI42S32400B SDRAM and application is stored in Intel Numonyx 128MB flash memory.

The Altera HardCopy II is a 350 MHz ASIC with 8847360 RAM bits that handles the translation of the telecom data protocol to a single bit data stream that is sent to the digital to analog converters in the transmit part of the board.

The Ericsson “WARP 1” ASIC labelled ROP 101 089/1 R1A is the encoding IC that takes the single digital data stream from the analog to digital converter and encodes it back into the telecom protocol to go back on the wired network.

The two connectors, that can barely be seen in the top of the picture, is the connections to the receiving part of the diplexer module.

The signal first passes through the 3rd order ceramic resonator bandpass filters and goes to the first Maxim MAX9993E down conversion mixers that brings the 1950 MHz signal down to a frequency between 40 to 350 MHz, by the use of the Analog Devices ADF4106 6 GHz local oscillators for the intermediate frequency.

A TriQuint SAWTEK 856496 208 MHz SAW filter, which is a sonic acoustic filter, insures a high efficiency isolation between first and second down conversion mixer setup.

The second Infineon 60744E, which is a unknown IC, down conversion mixer brings the signal even further down in carrier frequency by the use of the Analog Devices ADF4116 550 MHz local oscillator for the intermediate frequency.

At last the analog signals are converted into two channels of fast single digit data lines by the Analog Devices AD80137 which is a ADC with unknown specifications.

The input to the 3G / WCDMA part of the receiving circuitry goes directly to the circulator at the power amplifier board. I am not sure how this work, if it is just for internal measurements of the amplified signal or if it is a part of the cell network.

The signal goes through the Maxim MAX9996 down conversion mixer which changes the signal to a lower frequency with the use of the Analog Devices ADF4106 6 GHz local oscillator for the intermediate frequency.

At last the analog signal is converted to a digital data stream by the Analog Devices AD9233 ADC which has a 125 MSPS bandwidth at 12-bit resolution. This data is sent to the Ericsson “WARP 1” ASIC described above.

The Altera HardCopy II described above delivers the single digital datastream to the two Texas Instrument DAC5687 which are 500 MSPS bandwidth with 16-bit resolution digital to analog converters.

The clocking and timing of signals are controlled by several oscillators and crystals (Toyocom 491.54 MHz and Analog Devices ADF4001 200 MHz clock generator) around the DACs and a Analog Devices AD9510 1.2 GHz clock distribution IC handles the overall task of this.

The upconversion mixer ICs IRF370333 are unknown and uses the also unknown local GHz oscillator seen in the lower left of the picture.

The signal from the above described transmitting part of the main board comes into the two connectors in the upper left corner. From here it runs through 3 Xinger JP503S hybrid couplers for various phase shifting of the signal.

The pre-amplifiers are Freescale SW4IC2230GNB which are unknown, but a qualified guess would be that 4 is for 40 Watt and 2230 is for 2230 MHz, so it is rated somewhere along those lines.

The Infineon PTFA211801E high power RF LDMOSFETs handles the power amplification with their 180 Watt rating at 2110 to 2170 MHz.

The combined outputs run through the Xinger II XC2100A-30S hybrid coupler before entering the output circulator that ensures that the signal from port 1 exits at port 2 and any reflected energy from the antenna output on port 2 is absorbed by the 50 Ohm termination at port 3.

Posted in Teardown | Tagged , , , , , , , , , , , | Leave a comment

5kJ capacitor bank fired at 2kJ charge

Second charge experiment with the bank of 35 electrolytic capacitors connected in series. The bank did however not get charged to more than 50% of its maximum holding charge, properly due to too weak power supply. More results will follow when a new power supply have been made and tested.

All discussion about this bank can be found on the forum: https://highvoltageforum.net/index.php?topic=25.msg869;topicseen#new

The first test video can be seen at: http://kaizerpowerelectronics.dk/highvoltage/5kj-capacitor-bank-1-5kj-bang-test-at-end/

Posted in High voltage | Tagged , , | Leave a comment

MIDI modulator for DRSSTCs

I have had the Loneoceans midi2 controller for a while, just never got around to put it together, so now I finally have it boxed up, you can see how that was done here: https://highvoltageforum.net/index.php?topic=114.0

If you want your own MIDI controller, you can buy it here: http://loneoceans.com/labs/sales/midi2/.

Here are 4 videos I recorded while testing the MIDI functionality of the controller. They were all played back on the Kaizer DRSSTC II which is a mini coil resonating at ~300 kHz, so it will have a preference for high notes and not so much for the bass.

Ievan Polkka

The Imperial March

Dance of the Sugar Plum Fairy

Scooter – Friends

Posted in Tesla Coils | Leave a comment

Hacking the IKEA 2000 Watt induction stove, measurements (part 2)

Youtube video part 2 of 5

The second part of the series of maybe 5 chapters on tearing down and hacking a IKEA 2000 Watt induction stove is now published. Click the box below to read the whole article and get all the details.

Hacking IKEA 2kW induction hob

Highvoltageforum.net thread: https://highvoltageforum.net/index.php?topic=104.0

Posted in Electronics | Tagged , , | Leave a comment

Hacking the IKEA 2000 Watt induction stove, teardown (part 1)

The first part of a series of maybe 5 chapters on tearing down and hacking a IKEA 2000 Watt induction stove is now online. Click the box below to read the whole article and get all the details.

Hacking IKEA 2kW induction hob

Highvoltageforum.net thread: https://highvoltageforum.net/index.php?topic=104.0

Posted in Electronics | Tagged , , | Leave a comment

New online calculator: Snubber capacitor calculator

Calculate the needed snubber capacitance in order to protect your inverters IGBT/MOSFETs from too high swithcing transients, depending on your busbar layout and stray inductance.

Try the new online calculator at: http://kaizerpowerelectronics.dk/calculators/snubber-capacitor-calculator/

Posted in Electronics | Tagged , , | Leave a comment

Ericsson Radio Base Station RBS6000 teardown

The RBS 6201 two radio shelves can be equipped with virtually any combination of GSM, WCDMA and LTE, which are available for all common frequencies.

A single radio shelf can provide up to 3×8 GSM or 3×4 MIMO WCDMA or 3×20 MHz MIMO LTE or a combination of above standards.

The RUS supports 60 Watt output power for any standard with a bandwidth of up to 20 MHz. Each unit is capable of handling four cell carriers in both downlink and uplink. Multiple RU can be combined to create various single- or dualband configurations with 1-6 sectors and 1-4 carriers.

The RBS application software is distributed over several processors using the interprocessor communication offered by the platform. The main processors of the
RBS 6000 cooperate to form a main processor cluster (MPC) that executes most of the
control software. The processors that make up the MPC are equal in terms of control —
that is, there are no master-slave relationships between them. However, if one of the processors fails, the program execution is moved to another main processor in the
MPC. For control, most boards are equipped with a board processor (BP). Those units
that do not contain a board processor are monitored by other units.

The following 25 minute video shows the teardown step by step with explanations, high resolution pictures of content is in the last part of the video and also further down this post.

The system specific controllers are marked in the following pictures, these are handling system monitoring, telecommunication protocol decoding and encoding.

The system monitor CPU is the Ericsson ROP 101 1190/2 “AUC” which is a part of the earlier mentioned MPC. The Xilinx Virtex5 XC5VLX85T is a 550 MHz FPGA that either handles some system monitoring or the bus network interface.

The Ericsson ASIC ROP 101 089/3 “WARP 1” is at a best guess the encoding processors as they sit next to the analogue to digital converters described in the receiver part below.

The Altera Stratix III EP3SL150F780I3N is a 800 MHz FPGA that at a best guess is the decoding processor as it sit next to the digital to analogue converters described in the transmit part below.

Looking at the part of the circuit board that was marked receive in the above pictures, we can in the following pictures see the analogue signal from the diplexer is the input to the two golden connectors.

The main signal goes through the Anaren Xinger 1P603S hybrid coupler and best guess is that the phase shifted signal is distributed on to the smaller couplers and from there to the different signal monitoring parts of the circuits. The Analog Devices OP747 is a precision micro power op-amp and the Maxim MAX1154 is a 10 channel 10-bit system monitor.

The signal goes from the Anaren Xinger 1P603S to the Maxim MAX19997 Dual 2.3 – 2.7 GHz down-conversion mixer, which from the shielded Panasonic PA9F18 above it which is a ADF4153 local oscillator running at around 3 GHz, does a down-conversion from 2.6 GHz to 400 MHz according to the following formula. Intermediate frequency (400 MHz) = Local oscillator (3000 MHz) – RF signal (2600 MHz).

Sequencing and sampling is handled by the Analog devices ICs ADF4002 which is a 400 MHz bandwidth phase detector / frequency synthesizer and the AD9510 which is a 1.2 GHz clock distribution sequencer.

The signal is now split into two isolated lines through the TriQuint 856771 which is a 358.4 MHz SAW filter. SAW is short for surface acoustic wave and is basically two transducers on each their side of a piezoelectric crystal. The input transducer will make the crystal vibrate and the output transducer will generate a output from the vibrations, this is highly efficient at up to 99.99%.

The signal is fed from the SAW filters to a Skyworks SKY73084 300-500 MHz downconversion mixer which have the local oscillator right to it, but I am unsure of the frequency, but a guess is down to 20 MHz which is the advertised data bandwidth of the RBS6000 system.

Through unknown ICs and a passive filter the signal is now fed to the analogue to digital converters, the two Linear Technology LTC2208 ADC which are 16- bit and 800 MSPS. The digital data stream is now fed through the Texas Instruments LVDT386 250 MSPS differential line receivers to the Ericsson “WARP 1” encoding processors.

Looking at the part of the circuit board that was marked transmit in the first pictures, we can in the following pictures see the digital signal from the decoding processor is the input to the digital to analogue converters.

The Texas Instruments DAC5689 dual channel 800 MSPS 16-bit DAC converts the digital data stream from the Altera FPGA into a analogue signal that goes through the ST Microelectronics upconversion mixer marked 079/6 R1A BAJ HPACS Vd KOR 025, there is however no datasheet available for this IC. Neither is there for the last IC marked H305A MDB3 that sits just before the gold plated socket that goes to the power amplifier.

The following pictures shows the separate power amplifier module. It is apparent that this circuit board is made for many different layouts, frequencies or technologies from the amount of unpopulated areas on the board.

The input from the above transmit circuit on the main board comes through the input connectors to the right in these pictures. The first IC is not able to be identified but must be a preamplifier before entering the Freescale SW7IC2725GN integrated amplifier that also has no datasheet available. From here it goes through a small circulator to isolate the preamplifier from the power amplifier part.

The expanding boxes and funnel like traces are low pass filters and the many stubs and quarter circle quarter wave length traces are working as filters too, to either short or be open circuit at the RF frequency depending on them being grounded or not.

The NXP MRF7S27130HS N-channel RF MOSFET which is capable of 105 Watt CW mode at 2.6 GHz, the combination of the two outputs suggests that it is either a balanced amplifier or a Doherty amplifier setup, seen from the different lengths in the output paths.

The signal is phase shifted through the Anaren Xinger II XC2100-30S hybrid coupler and the isolation between antenna connector and power amplifier is done by the circulator. A signal entering on port 1 of a circulator can only exit on port 2, a signal entering from the antenna on port 2 can only exit on port 3 into the attenuation resistor that goes to ground. This is to prevent signals from going backwards into the amplifier.

Posted in Teardown | Tagged , , , , , , , , | 2 Comments

Ericsson Radio Base Station RBS3202 teardown

The RBS 3202 macro is an indoor Radio Base Station with one to four carriers and one to  six sectors at 20/40 Watt RF output power per carrier.

All the boards that I have comes from the middle row in the above picture and unfortunately I did not have any of the power amplifiers that are all at the bottom row.

In 1999 Ericsson had 17 test systems running around the world with WCDMA, which is better known as 3G among normal people. WCDMA stands for Wideband code-division multiple access. This RBS3202 indoor macro system is from around 2008. It also supports all these technologies GSM / EDGE, WCDMA / HSPA and LTE.

The RBS application software is distributed over several processors using the interprocessor communication offered by the platform. The main processors of the
RBS 3000 cooperate to form a main processor cluster (MPC) that executes most of the
control software. The processors that make up the MPC are equal in terms of control —
that is, there are no master-slave relationships between them. However, if one of the processors fails, the program execution is moved to another main processor in the
MPC. For control, most boards are equipped with a board processor (BP). Those units
that do not contain a board processor are monitored by other units.

The following 18 minute video shows the teardown step by step with explanations, high resolution pictures of content is in the last part of the video and also further down this post.

The circuit analysis was made rather difficult from all the custom marked Ericsson parts and other ICs where it is not possible to locate a datasheet.

In the above pictures we see the first system controller board which has the primary power supply input and splits it into multiply supply voltages that goes to the back plane and supply power to the rest of the modules. The bus connections are handled by a Lattice ispGDX2 fast serial I/O IC, it is a high bandwidth BUS interface that can run at speeds up to 38 Gbps.

The main CPU seems to be the Philips VP22530B3 with the Ericsson part number ROP 101 728/2, as this is the CPU that stands out from the identical processors on all the boards that are part of the MPC mentioned first in the article.

The board processor is a Ericsson “DBC” with part number ROP 101 1175/4 which has two Samsung K4S641632K RAM chips next to it, which are each 64MB RAM.

In the above pictures we see the second system controller board which at my best guess just do surveillance of the system. It has 3 identical Ericsson “SPUTNIK” ICs with the part number ROP 101 015/1 that connect to 9 high speed serial lines that goes to the back plane.

The board processor is a Ericsson “DBC” with part number ROP 101 1175/1 which has two ISSI IS42S16400B RAM chips next to it, which are each 64MB RAM.

The above pictures makes me believe that the pre-amplifier board is more of a DAC with filters that an actual amplifier. So I think this is just used for translation of the telecommunication protocols to analogue signal that can be fed to the power amplifier that we could see at the bottom of the system overview picture at the top of the article.

The large Ericsson CPU with part number ROP 101 10125/2 must be handling the protocol translation and feeds high speed digital data to the boards DACs, which are impossible to identify due to custom part numbers and such.

The only identifiable IC is a ADC, a Analog Devices AD9238B which is a 12 bit ADC that has dual channels with each a speed of 65 MSPS.

The board processor is a Ericsson “DBC” with part number ROP 101 1175/1 which has two Samsung K4S281632K RAM chips next to it, which are each 128MB RAM.

The analogue receiver output card that connects directly to the diplexer via a large pin header has a power supply part which seem to feed the diplexer board too. The different outputs at the left top are all split in A and B channel, from the hybrid coupler that gives a phase shifted signal and from the traces it can be seen splitting out.

The board processor is a Ericsson “DBC” with part number ROP 101 1175/3 which has two ISSI IS42S16400B RAM chips next to it, which are each 64MB RAM.

That board also have a first generation Altera Cyclone FPGA that maybe has to do with the connectors in the upper right corner near all the PCB cut-outs and the blue 50 Ohm termination to ground.

The diplexer top cover board also have a first generation Altera Cyclone FPGA in the lower left corner. At the top we can see the two monitor outputs and at the back of the diplexer are the transmitter inputs, these would connect to the power amplifiers sitting at the bottom of the cabinet.

The up side down L shaped cut-outs are the connectors from the diplexer tuned cavities to the antenna connector at the front. The two smaller clusters of SMD components that are on a slightly lighter colour of blue are receiving amplifiers that connect back to the back plane RF connectors and properly back to the pre-amplifier board for analogue to digital conversion.

It is worth noting that these two circuits are not identical, which can be seen in the close up pictures of each. It can also be seen how the signal is led from the circuits to the back plane by ground stitching that runs through and break some other stitching patterns.

The diplexer itself is a little unusual by having a printed circuit board as the top cover and from that design could only have the adjust pins from the back side going up through the columns and not as in many many other designs where the pins goes through the cover and down near the columns in the tuned cavities.

Posted in Teardown | Tagged , , , , , , | Leave a comment

5kJ capacitor bank, 1.5kJ BANG test at end!

For now all details during development and testing can be found on the forum thread: https://highvoltageforum.net/index.php?topic=25.0

35 capacitors in series, each 450VDC/1000uF, for a 48 uF bank with a voltage rating of 14000VDC, making it able to store roughly 5kJ.

Posted in High voltage | Tagged , , , , | 1 Comment