Teardown: inside a 3G microcell
I’ve admittedly had a bit of a love-hate relationship with AT&T’s 3G MicroCell and its femtocell alternatives from Verizon Wireless and others. On the one hand, it continues to irritate me that instead of building out their own networks, they’re requiring that customers buy (although some get ’em for free if they complain loud and long enough) a mini-cellular base station that routes cellular traffic over the customers’ broadband connections, eating into customers’ monthly broadband usage allocations in the process, and continuing to eat into customers’ monthly cellular usage allocations even though the cellular network isn’t being used. On the other hand, I can’t complain about the resultant coverage-reliability boost, and I realise that it’s not necessarily cost-effective for companies to expand coverage to low population density and/or challenging topology areas such the mountainous residence regions that I prefer.
A few weeks ago, I noticed that my AT&T-served iPhone 4S was no longer reporting that it was connected to "AT&T M-Cell" while at my Colorado home. A close look at my AT&T MicroCell there alerted me to the fact that only its front panel power LED was illuminated; the normally-lit LEDs indicating an active broadband connection, GPS "lock," and active local cellular network were extinguished. Several power cycles had no effect, nor did the unit respond to hard reset attempts. Another expired piece of tech… another teardown candidate.
Underneath the under-device information sticker, thumb-presses suggested what were confirmed by subsequent punctures to be two Philips head screws:
One of the analyses (PDF) I’d found during preparatory research indicated, "Upon unscrewing these, the orange bottom panel can be removed." Although this is true, reality was far more complicated than the statement (or at least my interpretation of it) implied. For several days, I strove to figure out how to pry off the bottom panel without doing substantial harm to the PCB behind it. Eventually, the simultaneous application of several screwdrivers did the trick; as you can see, AT&T and development partner Cisco didn’t intend for the process to be either easy or permanent-damage-free:
Peer closely at the lower of the two photos above, and you might be able to tell which of the side panels was next to get prying attention...[continues]
Peer closely at the lower of the two photos above, and you might be able to tell which of the side panels was next to get prying attention (the bottom one, since screws held the upper one in place). Retained only by a series of plastic tabs around its edge, it was pretty easy to pop off:
But accompanying the plastic panel, three small jumpers fell out of the unit as well:
I’d already been tipped off to their existence, albeit not their exact location. They’re a tamper-prevention scheme, albeit somewhat different in implementation than the one documented in an infamously scathing analysis published elsewhere. If they’re not present (or alternatively are installed/re-installed) in incorrect positions when the unit is powered up, AT&T tech support is automatically alerted to the device’s compromised state. Here are close-ups of the relevant jumper pin and retainer sites on the PCB and side panel:
Removing four more screws…
Removing four more screws, and popping more plastic tabs, enabled removal of the other side panel:
And once again, three tamper-detection jumpers tumbled to the table as the plastic panel separated from the main chassis:
Finally, after a bit more wriggling, the AT&T 3G MicroCell’s guts are fully exposed:
Your eye may first be drawn to the large heat sink in the upper left corner, but before we get to that, let’s look first at the memory subsystem … subsystems, to be exact, because the PCB contains two DRAM-plus-flash clusters. To the left of that heat sink are two Samsung K4T51163QG-HCE6 512 Mbit 667 MHz DDR2 SDRAMs; below them is a Spansion GL512P10FFCR2 512 Mbit MirrorBit NOR flash memory. Along the bottom edge of the PCB are two IC sites, only one of which is populated by a Winbond W9812G6IH-6 166 MHz 128 Mbit SDRAM. And in its upper right corner is a Macronix 29LV320DBTI-70G 32 Mbit NOR flash memory.
Why the seeming redundancy? I suspect it’s because the two DRAM-plus-flash memory clusters handle data and code storage functions for two different SoCs. The first, Ralink’s RT2150F, is located just to the left of the Macronix flash memory. It doesn’t seem to be a standard line item IC, but I suspect it controls the unit’s LAN and WAN wired Ethernet ports, as well as managing the routing function between them along with the data flowing between it and the cellular voice-and-data subsystem.
Now for that other mysterious IC below the heatsink. FCC certification report images indicate that it’s a picoChip PC203 femotocell SoC, which at-release mid-2008 coverage at EE Times identifies as being "a single-chip solution for HSPA femtocells compliant to TR25.820 and the newly standardised Iuh interface. Supporting up to four users for residential and SME femtocell access points and with data rates of 14.4 / 5.7 Mb/sec in downlink and uplink respectively the PC302 enables the lowest bill-of-materials and lowest power for a femtocell available today." It was followed by a femtocell reference design a year (and a few months) later; I’d be curious to know how closely the Cisco-developed 3G MicroCell hews to it, if any of you have information. picoChip was subsequently acquired by Mindspeed Technologies in early 2012.
To the right of the picoChip PC203 is...[continues]
To the right of the picoChip PC203 is a Xilinx XC3S400A Spartan-3A FPGA (PDF), whose exact functions in the system are unknown (because, duh, it’s user-programmable) but likely handles various high-speed signal processing tasks in partnership with the SoC next door. And next to the FPGA is the cellular radio analogue subsystem, underneath a Faraday cage. Prying the top off it, and further moving to the side a secondary metal slice, reveals what’s inside:
In addition to the inevitable pile of passives, you’ll find two Maxim-supplied ICs. The markings on the MAX2597 to the far left are barely visible; the product page on Maxim’s website identifies it as a "Femto-Basestation Bits-to-RF Radio Transmitter." If you’re guessing there must be a corresponding RF receiver somewhere, you’d be right … the MAX2557 is just to the right.
Speaking of receivers, where’s the GPS subsystem? The bright yellow-labeled IC in the bottom right corner of the PCB is RoyalTek’s REB-1315LPNX (PDF) single-chip digital-plus-RF GPS receiver. To the right of it is the femtocell’s integrated GPS antenna, and below it is the connector for the optional (and included) external cable-tethered GPS antenna, in case you’re unable to obtain GPS "lock" at your preferred femtocell location.
Speaking of antennas, where’s the cellular aerial? I suspect it’s built directly into the PCB (readers: agree or disagree?). Shining light through the circuit board makes it more visible:
And speaking of connectors, I’ll close out the discussion of the PCB top-side with a left-to-right revelation of the remainder of the bottom-edge residents: power connector, hard reset switch, WAN Ethernet port (labelled "Ethernet"), and LAN Ethernet port (labelled "Computer"). Use of the latter is only necessary (and wasn’t in my case) if firewall restrictions preclude you from putting the 3G MicroCell behind your network’s normal router. Then again, in this case your LAN would become double-NAT’d as a result, which causes all sorts of problems of its own … above the Ethernet connectors are the corresponding transformers.
Finally, let’s take a peek at the PCB backside:
Not much to see, aside from the aforementioned tamper-detection jumper pin block, a few rows of what I presume are test points, and some chip-clustered passives.
Speaking of power connectors, what caused the 3G MicroCell’s demise? The "wall wart" is one possibility; although my limited testing suggests that it’s still working fine, its current-source capabilities may have degraded to the point that they’re only sufficient to illuminate the front panel power LED (I’ve personally experienced such strangeness in the past). More likely, however, is that a periodic over-the-air firmware update “borked” the femtocell, or some other software and/or hardware failure clobbered it. Fortunately, I’ve got a spare to press into service as its successor.
If you enjoyed this article, you will like the following ones: don't miss them by subscribing to :