Nokia Siemens Networks Flexi WCDMA teardown: System station (part 1 of 3)

Nokia Siemens Networks Flexi Multiradio BTS is a GSM/EDGE, WCDMA/(I-)HSPA, and LTE base station for use in mobile telecommunication antenna networks. A network that you use daily on your cellphone.

In the above picture we  see the first DSP board that was visible when the first shield was taken off the enclosure. Please watch the following video to get a detailed description as I take it apart. Details on all the ICs, CPU and controllers follows in the pictures below the video.

In the above pictures there is a Freescale SC8548CVTANGB PowerQUICC III CPU which 2-16 GB Samsung memory. Other ICs include Texas Instruments ACH973, NXP LVC823A and Spansion GL512P12FFIV1.

In the above pictures there is Texas Instruments TMS320TC16488ZUN DSP processor, Lattice POWR1220AT8 programmable power supply controller and Marvell 88E6185-LKJ1 10-port Gigabit ethernet switch. There was a total of 14 Texas Instruments TMS320 DSP processors with each 28800 MIPS in processing power, combined that is over 400000 MIPS and corresponds to calculating power of 3x Intel Core i7 4770K CPUs.

In the above pictures there is a TDK Lambda iQE48025A050V-0A1-R switch mode power supply with planar transformers that uses gold traces in the PCB as windings.

In the above pictures there is a four ethernet ports out to the left which connects to the isolation transformers Pulse HX5004NL and HX1188NL. The network interface is managed by the Marvell Alaska 88E1145 Gigabit quad-port ethernet transceiver.

In the above pictures there is a Epson Toyocom OX-6500GG temperature controlled 30.72 MHz crystal oven that is stabilized by always keeping it at a constant temperature. Above it there is a Altera Cyclone II FPGA from the EP2C5 family and this model has 4608 LE’s, 119,808 RAM bits and 158 user I/O pins.

In the above pictures there is Texas Instruments TMS320TC16488ZUN DSP processor, Lattice POWR1220AT8 programmable power supply controller, Marvell 88E6185-LKJ1 10-port Gigabit ethernet switch, NEC 4374360MUKSU2 CPU which is unknown to me, a Spansion GL01GP13FFIV1, NXP LVC373A, Texas Instruments ACH973 and a Toyocom TCO-2111N2 153.6 MHz crystal.


Frequency bands: 700, 800, 850, 900, 1800, 1900, 1700/2100, 2100, 2300 and 2600 MHz.

Maximum capacity: Up to 6+6+6 GSM or 4+4+4 WCDMA or 1+1+1 LTE at 20 MHz or flexible combination of the above technologies in concurrent mode.

Multi-radio configuration: 1 Flexi 3-sector RF module + 1 system module for GSM/EDGE + 1 system module for WCDMA/HSPA and LTE. Remote Radio Head (RRH) solution also supported.

RF power amplifier technology: Multicarrier power amplifier (multi-standard)

Height x width x depth: 133 x 447 x 560 mm per module, indoors and outdoors. Fits in any 19” rack.

Weight: 25 kg per module

Operating temperature range: -35 °C to +55 °C

Power supply: 40.5 – 57 VDC, 184 – 276 VAC with power module

Typical power consumption: 790W for combined GSM and WCDMA site

Output power: 240 W per RF module or 40 W + 40W per Remote Radio Head (RRH)

Ingress protection class: IP 65

Posted in Teardown | Tagged , , , , , , | Leave a comment

Ericsson RBS 2216 900 MHz base station teardown

The Ericsson RBS 2216 is a 900 MHz GSM base station that would have been installed at the base of a antenna somewhere out in the field of mobile telecommunication networks.

The enclosure contains one BFU-31 battery fuse and relay unit, three PSU-AC 27.2 VDC 1520 Watt power supplies, one DXU-31 central processing unit and 6 DRU9E-01 power amplifier and bandpass filters.

I will go through the different units starting with the battery fuse unit, then the CPU, then the power supply and at last, which also have a long teardown video, the power amplifier.

Battery fuse unit BFU-31

The battery fuse unit has two large connectors for the battery and some other external unit that I am not sure what is. The reason for knowing there is another external unit is that the connector marked “RBS” is in series with the “Batt” connector and the relays inside only handle one wire potential.

The long green connector has external alarm options from malfunction in the fuse unit. There is 8 pairs of NO/NC relays to be used. A small microcontroller on the board has feedback from various position switches on the large relays/fuses, voltage feedback and current feedback from a current transformer.

The unit contains a 80 VDC 270 A circuit breaker, a 260 A relay CZJ-260S/30.60A and 80 A relay CZJ-80S/30.60A. A Honeywell CSNS300M-001 current transformer that can measure up to 600 A DC or 825 A AC.

Central processing unit DXU-31

I think that the actual computer CPU is the PowerGarp RGP 101 1192/1 R3A since it has 512 MB SDRAM associated with it. I have not been able to find any further information on this IC.

Communication and network is handled by the Infineon QuadFALC PEF22554 HT IC.

I guess that the telecommunication protocol handler is the Ericsson VP22295-2 CPU which is connected to the Y-link ports and a 32 MB CF card.

The CF card contains 91 files and 2 sub folders with a total of 22.6 MB of data. All the files are without file extensions and on a FAT formatted file system. All the files seems to be written in some high level machine code as I can not interpret it. About half of the files does however also contain plain text which is mostly status and error messages. Following is the content of a file called “COLD_29K” which seems to be a cold start routine with error messages.

# – Coldstart
# – Processor revision < B4. Halting.
# – Restart counter limit exceeded.
# – Page mode not enabled.
# – Halting, no base appl found.
# – Starting DXU base appl.
# – Starting TRU base appl.
# – Starting ECU base appl.
# – Uncompress start.
# – PLS appl start.
# – Initiating all RAM.
# – Coldstart parity trap occured.
# – chc: 0x cha: 0xpc1: 0x cps: 0x# – Gr95 content: 0x

There are several other references in file names and within files to “29K” which seems to be the call name of their microcontroller.

Power supply unit PSU AC

There is not much to tell about the power supply unit. It is a solid piece of hardware that can deliver 1520 Watt power at 27.2 VDC. There is some trimpots in the middle of the PSU when you have the plate and heat sink removed, the one sitting closest to the middle of the group of three is able to adjust the output voltage, so it is possible to set it up to just about 28.2 VDC for use in HAM radio applications.

Power amplifier and band pass filter DRU9E-01

I made a video that describes the teardown of the amplifier and bandpass filter in much greater detail.

Different parts of the board shown in close up.

The Ericsson Tarac X CPU with the markings ROP 1011503/R1A F751500GPA 980 75P0P88 C has a total of 256 MB SDRAM.

The PowerGarp CPU with the markings RGP 101 1192/1 R3A has a total of 512 MB SDRAM

The couplers are Anaren Xinger II XC0900

The HDSL front end is a Analog devices AD7346A that converts the High-bit-rate digital subscriber line (HDSL)telecommunications protocol into a analog signal.

The transmiting transistors are 2x PTF080901E LDMOS RF Power Field Effect Transistor 90 W, 869–960 MHz.

The 20db attennuator is a RFP1398 rated for 100 Watt.

The receiving amplifiers have eight Analog devices AD7724 Dual CMOS Sigma-Delta modulators to convert the analog signal into a high speed 1-bit data stream.


Posted in Teardown | Tagged , , , | Leave a comment

GSM 900 MHz power amplifier teardown

I had the opportunity to take apart a GSM 900 MHZ power amplifier and band pass filter. Here I will show you how it is built and explain a little about the various mechanisms inside the filter.

Posted in Teardown | Tagged , , | Leave a comment

Photomultiplier scintillation experiment

I have successfully detected something, this might sound a little uncertain, but there definitely is detected some kind of radiation or particle energy that causes varyous levels of light generated in the BC408 scintillation plastic that is attached to the front of the photomultiplier tube.

I have updated the article about the photomultiplier tube with all the details and measurements from this short proof of concept test.

Just the fact that a PMT assembly straight out of a industrial application can be reused for physic experiments after it has been fitted with a scintillation crystal or plastic is a huge leap towards cheaper amateur science in the fields of neutron detection, muon detection and cosmic ray detection.

Posted in Electronics, High voltage, Technology | Leave a comment

New Youtube channel and Google+ page!


Kaizer Power Electronics now has its own separate Youtube channel and Google+ page, so that you can follow, subscribe and comment on just those topics related to Tesla coils, high voltage and electronics that you so desire 🙂

Please subscribe to the new Youtube channel at: Kaizer Power Electronics on Youtube

Please follow on the new Google+ page at: Kaizer Power Electronics on Google+

And remember there is still the same Facebook page, nothing new here, but like it if you want frequent updates: Kaizer Power Electronics on Facebook

Posted in News | Tagged , , | Leave a comment

Kaizer DRSSTC III update #5 – First full power light!

The first full power light sparks have been flown and the results was more than satisfying!

See the videos and pictures in the full article!

Posted in Tesla Coils | Tagged , | 2 Comments

Reverse engineered AGFA photomultiplier tube module

I have finished the first steps that included mapping the circuit boards, getting the unit to run and test it with a few simple test and finding out which input and outputs the module have.

Schematics and further experiments with f.ex. scintillation crystals are set for the near future and will be announced when they are added.

Read the full article on the reverse engineering of the AGFA-IUP3 photomultiplier tube module

Posted in High voltage | Leave a comment

Teardown – Eaton Powerware 30 kVA UPS

I had the chance to take this Eaton Powerware 30 kVA / 27 kW (9355-30-N-7-2x9Ah) uninterrupted power supply apart to look for parts worth salvaging for future reuse in other projects.

Looking up the type on the Eaton website we learn that it is a UPS using double conversion topology that provides isolation from all input anomalies on the output side. Double conversion means that there is AC to DC converter that is connected to the battery pack and the DC to AC converter, a total of two power conversions.

The use of 432 VDC battery pack makes the whole construction smaller and more light weight, the higher voltage avoids the use of step-down or step-up transformers, large switches to handle high current at low voltages but it also adds another danger element as a high voltage battery is not as easy to service and failures can be more catastrophic. This design is called transformer free design, but apparently they do not count in the large choke transformers in the inverters.

The following schematic shows the block diagram of a double conversion UPS.

Viewed from the side we can see the four compartments for batteries, with this rather small battery stack this unit is only able to keep up for 7 minutes at its rated load of 27 kW.

In the close up picture of the circuit board, we can basically see the complete controls of this unit. Out to the far right is the CPU board, top of it connects out to the inverter modules and at the bottom its outputs for relays / switch timing on the large main circuit board.

All wiring was unfortunately cut off when I got to the unit, but looking at the amount of cable shoes still sitting in the bolts, I can safely assume that the PFC connects our to the left side terminals, one inverter module connects at the top terminals and at the bottom near the three black current transformers two inverter modules have been connected in parallel.

Four 230 VAC 15 Watt fans ensure the cooling of the IGBT switches and chokes.

Below the fans we can see the three identical inverter modules, they were easily pulled out when the copper busbars was disconnected. The copper busbars is the battery rails between the the input conversion and output conversion.

At the following pictures of one of the modules it can be seen that they are very generic, not meant for a very specific task, but is merely a dumb inverter module that is connected to a control bus for input signals.

The IGBT modules Semikron Skiip 25AC125V10 are ultra fast NPT IGBTs, rated for 1200 V and 100 A pulsed, combined switching time is a mere 600 ns. Each of the IGBT switches has its own output choke.

The circuit board contains a few ICs at the data bus connector, three isolated power supplies for the six gate drive circuits. From the number of drive circuits and tracks to the IGBT gates it is clear that these 3 phased bridge IGBTs are driven with the three upper dies in parallel as the same for the 3 lower dies of the brick. The four electrolytic capacitors are connected two in series and two of those strings in parallel for 3000 uF at 900 VDC rating.

The PFC circuit board has three SKKT 122/16E thyristor half-bridge modules, rated at 1700 V and 130 A. In the lower left of the close up picture we can see PFC controls which consists of normal logic ICs and a PIC processor that is connected to the CPU on the main circuit board through the RJ22 connector.

On the upper left side of the circuit board is the various house keeping power supplies for all of the control circuitry and networking interfaces of the UPS unit.

A very modular design that was easy to take apart, but unfortunately not that great on collecting useful parts. The lack of large IGBT bricks and capacitors is the worst let down of this unit.

Posted in Electronics, Teardown | Tagged , , , | Leave a comment

Teardown – Schneider Electric frequency inverter ALTIVAR71

I picked up two of there 5.5kW frequency inverters from a scrap yard. Both assumed to be thrown out due to malfunction. I took them home to dismantle them for parts to use in other projects.

First we have the front and two stickers, one with specifications and the other with end of life information. These are fairly new units from 2013.

Removing the front metal plate and display unit, in the upper left corner we can see the house keeping power supply part of the main board, just below we can see the input filter PCB and upper right corner in the beige plastic we have connector and terminals for input/output control signals. A close-up of the input filter show that we have a varistor between phases and two 1 uF capacitors in parallel for each phase to ground.

The main board has the low voltage power supply for logic and gate drive in upper left corner. All control is done in the upper right corner, at first is the 3 phase PFC with output wires to the 3 SCRs for the input rectification, to the far right is brake chopper part. Below that there is resistor chains used for some kind of voltage feedback from the brake chopper and at the bottom of the board is the three gate drivers with each their connector with coloured cables red, yellow and blue that goes to the gates of the main IGBT brick.

With the main control board removed we can see the three phases from input terminals that go to connect at the SCRs and their gate drive wires sticking out at the top. Below is the brake chopper with wires going back for voltage feedback. The beige box with the red wires looping through three times is the current transformer used for monitoring of the inverter output current to the motor terminals.

All capacitors needed for filtering and snubbering around the SCRs and brake chopper is mounted on the PCB that is turned upside down here. The SCRs are Semikron SKKH 57 / 22E H4, rated for 2200 Volt at 57 Ampere.

With all boards and wires out of place we can see the main power board. In the upper left corner is four connections to a choke that is placed underneath with the heat sink. Just below we can see the + and – marking on the PCB where the two electrolytic filter capacitors are mounted, also underneath with the heat sink. The choke and capacitors are down there to be cooled by the same air flow used for cooling of the heat sink.

The main IGBT module is a Semikron FZ100R17KE3 rated for 1700 Volt at a mere 200 Ampere repetitive pulsed current. The brake chopper is a Semikron SKM145GAL176D single IGBT rated for 1700 Volt at 100 Ampere.

The two electrolytic capacitors rated for 1100 uF at 550 VDC is connected in series to handle the DC bus voltage if the frequency inverter is supplied from 3x690VAC. Two 80 mm large 7.2 Watt Sunon fans run at 4900 RPM to move 75 CFM or 120 m3/h.

The 1500 uH choke is rated for 40 Ampere RMS or 30kW power. The long slim heat sink have all the SCR and IGBT modules mounted on it and run along side the choke and filter capacitors as mentioned earlier.

As an extra bonus in this teardown, I have taken some high resolution pictures of the FZ100R17KE3 IGBT dies, one from the IGBT that seemed fine and one that was exploded. This makes for a good comparison of the magnetic forces at play in the event of a short circuit inside the IGBT goo. The long and flat flower like black paths in the goo is actually the gasses from the  exploded IGBT die, the gas expands out into the goo that blows a bubble and collapses as soon as the pressure is gone. Leaving a black trail of burned silicon, metal and goo. These are 3MB pictures.

GS6A9628 GS6A9629 GS6A9631

Last two are die close-up photos, I tried to align them to show the exact same area of a good and a exploded IGBT. These are 9MB pictures.

GS6A9635 GS6A9637

Posted in Electronics, Teardown, Technology | Tagged , , | Leave a comment

New online calculator for IGBT gate drive

I added a new online calculator that will help you do the calculations for IGBT gate drive. It is useful for continues wave operation and has a optional input and output for use with Tesla coils like DRSSTCs.

Check it out!

Posted in Electronics, Tesla Coils | Tagged , | Leave a comment