Setting up a BTS3900 for LTE from scratch using MML
Category Archives: RF
Inside a 32×32 MIMO Antenna
A peek under the radome of 32×32 5G Active Antenna Unit
Ericsson & Nokia RRU Power Connectors – Wiring and Tricks
Assembling Amphenol RRU power connectors and modifying them to work with Ericsson and Nokia RRUs.
Huawei Baseband Cheat Sheet
Quick reference guide for the types and capacities of Huawei BBU 3900 Series cards
Forsk Atoll – Importing Antennas
Importing .msi antennas radiation patterns into Atoll
Converting Elevation Data (DEM) for Forsk Atoll
After headaches importing elevation (DEM) data into Forsk Atoll, I found a better mechanism for converting them, I’d been having issues with as soon as the elevation passed 255 meters, resetting to 0 in the PNG as it didn’t understand values beyond this. I was able to open the elevation data in GlobalMapper (You can … Continue reading Converting Elevation Data (DEM) for Forsk Atoll
Huawei BTS3900 – MML Basics
Learning Huawei’s flavour of MML – Man Machine Language for the BTS 3900 series Macro Base Stations.
DIY LTE RAN Adventure – POWER! (systems)
All the gear I’ve got so far for my DIY RAN Project requires -48vDC to power it up.
Back to online auction websites and preso I’ve ended up with an Eltek MPSU3000, from the mid 2000s.

The fellow I bought it from was even nice enough to throw a binder full of printed documentation, which included a full circuit layout diagram, however this was obviously in the days of old school printers, and each of the colours were offset, providing a literal headache when reading and a bit of a reminder of what printed documents were like to deal with…

So after a bit of tinkering, wiring and reconnecting the temperature probe, I managed to fire the unit up,
While it complained about the absence of batteries (As well as rectifying AC to DC it manages and maintains banks of batteries to provide a backup power supply), it worked, and provided a very stable, clean -54v DC.

I’ve got a very old (1948) Ring Generator / Ring Machine, (same as this one) so I wired it into the rectifier and it came to life, drawing 3 amps in the process.
The Huawei gear uses proprietary power connectors, I’ve managed to start it using crocodile clips and good luck to get it powered up, but I’ve got to work out a more permanent solution before I can rack all the gear and have it setup properly.
The Eltek rectifier has a number of relay contacts in the unit that can be programed to trigger in different conditions, ie mains power lost, battery fault, over temperature, etc.
These relay contacts are then wired into some sort of alarm input, to share alarm state with external monitoring equipment. (Modern rectifiers just have Ethernet and connect over TCP/IP, but this one just has a serial port and an AT command set for connecting it to a dialup modem.)
The BTS3900 has the Universal Power and Environment Unit (UPEU), which allows me to connect external alarm inputs, for things like this, water sensors, smoke detectors and intruder alarms, so hopefully I’ll get that in place when I’m further down the line.
But to program these requires the software, which I couldn’t find anywhere online. As a last ditch attempt I reached out to the manufacturer, Eltek, and asked if they’d be so kind as to send me a copy. I wasn’t expecting much, but the next day, they sent me back all the manuals and the software the next day, for a 15 year old, long surpassed product. Very impressed!
So with the aid of VMware, Windows XP, USB-Serial adapters and jumper wires, I managed to connect to the Rectifier Controller with the software and had a poke around.
While the unit can do some very clever things with battery management, for my lab setup I can’t see myself going to the effort of adding batteries. So for now the Rectifier’s just converting AC mains into -48vDC, but I may string some batteries in the future.
For anyone who’s ended up here looking for info on these units, or the first generation Eltek Flatpacks, I’ve attached some documentation below. The software isn’t readily available online, so I won’t post it here, but you can get it from Eltek directly.
So power system check! Now onto configuring the unit and getting the radios online…
DIY RAN Adventures – Antennas
Picking and validating antenna selection for the new RAN project in my lab.
Using a NanoVNA to analyse SDR Base Station Antennas
Using a NanoVNA to analyse antenna performance for SDR driven Base Stations for GSM / LTE.
GSM with Osmocom: Handovers
A look at the Handover process between Cells / BTSs in GSM using the Osmocom stack.
GSM with Osmocom: Channel Types
When setting up the timeslots on the TRX for each BTS on your BSC, you’ll notice you have to set a channel type. So what do these acronyms mean, and how do they affect the performance of the network? GSM channels break down into one of to categories, control channels – used for signalling, and … Continue reading GSM with Osmocom: Channel Types
GSM with Osmocom: GPRS & Packet Data
So far we’ve focused on building a plain “2G” (voice and SMS only) network, which was all consumers expected twenty years ago. As the number of users accessing the internet through DSL, Dial Up & ISDN grew, the idea of getting this data “on the go” became more appealing. TCP/IP was becoming the dominant standard … Continue reading GSM with Osmocom: GPRS & Packet Data
Dumb Lesson in RF Connectors
When the YateBTS project launched 6 or 7 years ago I went out and purchased what was to be my first “real” SDR – The BladeRF x40.
At the time I wanted to play with GSM stuff, and so I grabbed two rubber duck antenna off an Alarm GSM Dialer I had in a junk box, thinking they’d do a better job than the stock “everything-band” antenna that came with the SDR hardware.

These two became my “probably roughly aligned with the common commercial RAN bands” antennas,
I’ve used these antennas on pretty much all my RAN related projects on the BladeRF, HackRF and the LimeSDR,
GSM with YateBTS GSM with Osmocom LTE with srsLTE
I had some issues a recently I attributed to “probably rubbish antennas” so decided to get a pair of paddle antenna tuned for the frequencies I was working with.
While working out what to get I had a look and noted the connectors on all my SDR hardware is SMA-Female connector. Easy, so I need an SMA-Male connector on the antennas, purchase made.
Cut forward to today when the antennas arrive at my door, they’re exactly as described, however I notice some resistance when connecting them, the male pin is stiff to go into the LimeSDR, whereas there’s no resistance at all from my “trusty” rubber duck antennas.
That’s when I realised.
The two antennas I’ve been using for about 7 years at this point, have the wrong connectors (SMA and RP-SMA) and have not made contact on the signal centre pin that entire time…
They’re RP-SMA male and I need SMA male.
Wasn’t just reverse polarity – it was no polarity.
I’m a walking encyclopedia of connectors, acronyms and layer 1 stuff, but apparently this I missed.
I’m an idiot – a lucky one who didn’t burn out his SDR hardware.
An idiot with greatly improved RSSI though…
NBN Skymuster Satellite Technical Overview
I’m a bit of a radio nerd & I’ve worked Satellites before, so the Skymuster / LTSS program had me curious. So here’s some nitty-gritty details on NBNCo’s Skymuster Satellite service.
The Payload
NBNco called the LTSS (Long Term Satellite service) but before launch they re-branded as “Skymuster”.
NBNco provided an Interim service called ISS (Interim Satellite Service). before the launch. IPSTAR satellite (Formerly ABG) and Optus services delivered this. Both of these had limited bandwidth and has since been largely replaced by the Skymuster / LTSS.
NBNCo contracted Space Systems / Loral, a US based satellite manufacturer to design and build the payloads. It’s based on the SSL 1300 platform.
When deployed, the payload itself measures 26 metres long, 9 metres tall and 12 metres wide, and weighs in at 6400Kg. Before deployment, in the satellite’s compressed form it fits within a 5-meter launch-vehicle fairing.
Communication to earth is via Ka-band frequencies which allows for greater density of spot beams and frequency reuse. However, capacity improvement through higher frequencies does come with some tradeoffs. Ka-band frequencies, are more susceptible to weather related conditions compared to Ku-band frequencies. Directional accuracy becomes way more important when aligning the customer dishes in Ka band also.

Direction | Min Freq | Max Freq |
Earth to Satellite | 27Ghz | 31Ghz |
Satellite to Earth | 17.7Ghz | 22Ghz |
These emissions are within the range of the higher end software defined radio receivers. I’m curious to see what’s being transmitted, but that’s a topic for another day.
The downlink uses RH and LH circular polarisation.
The Journey
SSL assembled the satelite in California.
SSL staff packed it into a crate and loaded into the belly of an Antinov An-124 which is flown to the launch site.




There are two Skymuster Satellites, NBN-Co 1A & 1B. 1B provides infill / capacity layer for 1A but both are identical. If the 1A satellite was lost during launch / deployment, 1B could be sent up in it’s place. This is still a real risk when launching anything.
NBN-Co 1A was the first launched, riding on a Ariane-5ECA from Guiana Space Centre in French Guiana, South America. 1A launched on 30.09.2015 and 1B launched 05.10.2016 in the same configuration.
After launch to a transit orbit, the satellites had to navigate up into a geostationary orbit at ~36,000Km. This was done using it’s 4 × SPT-100 plasma thrusters, which are exactly as cool as they sound. The final navigation process took up 40% of the fuel in the satellite. Fuel is the determining factor for the expected ~15 year lifetime of the two satellites.

Once in final position SSL performed 2 months worth of tests referred to as “In Orbit Testing”. SSL then handed over operational Telemetry, Tracking and Command (TT&C) to Optus Satellite (Singtel). Optus are tasked with keeping it in it’s current position.
Customer Hardware
Ericsson manage the installation, and subcontract to Hills and Skybridge for the actual work.
Out Door Unit (ODU)
There are currently 3 Satellite Antenna options that are available for
installation, 80cm, 1.2m & 1.8m.

Narrower Ka-Band signals drops off more rapidly than Ku-Band signals. This means that aligning the Ka-Band antenna within the degrees of usable Azimuth within the Line of Sight maximises the antenna gain.
Required accuracy for each of the antennas:
- 80 cm: 1.4 degrees,
- 120 cm: 1.0 degrees
- 180 cm: 0.7 degrees
The below graph shows being off by 1 degree from the required accuracy, leads to -30dB drop. This translates to a power ratio of 1000, or 1/1000 of the power if correctly aligned.

The alignment process is done by the installer pointing the dish in the correct azimuth / elevation. This is based on compass / inclinometer readings, or smart phone apps. Once a rough alignment has been set, a tone-generator on the TIRA is used to align the dish.
This process requires a 16 digit installation key.
The key containing the frequency used in the installation, beam Assignment & TRIA Polarisation (The 6w version has automatic (Polarisation).
That’s entered into the installation setup page at:
TIRA’s has a built in Tone Generator which is used to “Point and Peak” the dish from the roof. The tones are:
- Heartbeat 3KHz
- Pointing Tones 2.5 – 3.1KHz
- Peaking Tones 2.5, 2.95, 3.1 and 3.3KHz




ViaSat have videos on how the alignment process is performed.
IDU (Modem) / NTD
The modem itself is manufactured by ViaSat. I can’t find any specifics it seems to be in the RM511x line of Satellite modems.
There were some issues with a firmware update on these in 2018, that saw firmware getting rolled back.
The modems / IDU / NTDs for the ISS are not compatible with the LTSS.
There’s some nice teardown photos of a similar ViaSat modem here.



TRIA (Transmit/Receive Integrated Assembly )
The TRIA is the equivalent of a feed horn, an all in one Tx/Rx assembly. They are available in 3w and 6w variants, based on the estimated signal levels of the installation location. That’s determined by factors like high rain areas or if the subscriber is on the edge of a beam.


The 6W version has an extra F-Connector for the required DC power injection. The 6w version also has a two F-Connector gang-plate / wallplate when installed for the second RG6 run to power it.

Interestingly there’s a minimum length of cable run (8m) specified for these installations. Anything less than 8m leads to lower resistance and possible overheating.
There is a minimum length of 8m for the cable run this is very
important as it provides the right amount of cable resistance so
the modem does not get hot and over heat. Max cable run is 50m.











Configuration
Transparent Performance Enhancing Proxy (TPEP)
TPEP aka Web Acceleration, is a service offered by NBNco to spoof TCP replies, to make the handshake more efficient. It can, unsurprisingly, lead to headaches accessing services, particularly those that employ TLS.
Web Interface
http://192.168.5.100:8080/xWebGateway.cgi
user name = ADMIN and the password = operator (lower case)
Beam Selection
The installer key sets the beam, and his can be remotely changed by NBNco MAC / NOC team.
BIRRAUS have a good article explaining the spot beams available.


Educational Port
Like the other NBNco NTDs, there are multiple UNI-D ports available on the Skymuster modem allowing segregation of services.
One option that seems to be gaining traction is a dedicated port on the modem for educational use, on one of the UNI-D ports on the modem.
Educational Ports are configured to allow access for remote / distance education students.
The local state government sets pricing, speeds and data usages.
Ground Stations
There are 9 active and one standby ground stations, geographically spread across Australia, with a standby in Wolumna, NSW. The standby is capable of assuming control for any of the other ground stations.
ViaSat built the equipment and services different spot beams.
Again, BIRRAUS have this covered in their article, but here’s an extract they’ve made listing the ground stations and beams serviced.


Future
Solar Transit
Solar transits happen twice yearly when the satellite is aligned directly between the sun and Australia.
The immense solar radiation from the sun overloads the transceivers on the ground, as they’re positioned at the satelite, with the sun behind it overloading the signals.
This lasts for about 6 minutes twice yearly, and affects different ground stations and each of the satellites at different times.
Copper Cutoff
Currently the copper decommissioning does not apply to Skymuster services. This means customers with a copper POTS line, can keep it indefinitely.
This has lead to headaches with incumbent providers who had intended to decommission / sell off remote exchanges, but will be required under Universal Service Obligation to keep them active.
3rd Satellite
Due to unexpectedly large uptake of Skymuster services, NBNco had floated the possibility of launching a 3rd Satelite in 2020:
Scenario 3: Third satellite – This scenario assumes that NBN Co constructs and launches a third satellite at the end of CY20. This mitigates the need to build some fixed wireless base stations and FTTN distribution areas. The capacity of this satellite will only be partially required to meet NBN Co’s needs
Scenario 4: Third satellite in partnership – This scenario mirrors Scenario 3, but assumes that NBN Co enters into a partnership with an external party to access only the required capacity on a third satellite rather than building and owning it outright.
Source – NBNco Fixed Wireless & Satellite Review
Portable Services
Apart from spot-beam migration, there are no technical limitations preventing portable Skymuster services from becoming a service offered.
Qantas are using this to power the in-flight WiFi on their domestic fleet of 80 Boeing 737 and Airbus A330s. Though it seems that may no longer be the case.
The NBNco launched a fleet of “Road Muster” 4WDs for promotion of the services. They drive from town to town, spruiking the benefits of Skymuster.
On the roof of the 4WD is a Satellite ODU, which seems to be self / remote positioning.

Online sleuthing reveals it’s a EXPLORER 8120 manufactured by Cobham. It featuring auto-acquire, drive-away antenna system using Dynamic Pointing Correction technology. At $32k USD, it’s rather pricey, and outside the range of most grey-nomads and campers.
If a user wanted to manually position the dish, they could using a service like DishPointer.com or Wolfram Alpha. This would give a rough alignment and then the tone generator “Point and Peak” for the fine adjustment.
Layer 3 Services
Skymuster services are setup as L2 services.
NBNCo has highlighted from day 1, the option of using Layer 3 for deliver to enable deep packet inspection.
This would allow them to prioritise traffic more easily / efficiently.
Corrections
Please let me know in the comments if I’ve got anything here wrong.
GSM with Osmocom Part 9: Calls & SMS at last!
So now we’ve covered the basics of what’s involved let’s get some traffic on our network. For starters we’ll need to start each of our network elements and bring up whichever BTS hardware we’re using. In order for our calls to have audio, we’ll need to set a parameter on the Media Gateway. We’ll cover … Continue reading GSM with Osmocom Part 9: Calls & SMS at last!
16 in 1 Magic SIM Card Revisited
Quick look at cheap “Magic SIM Cards”, what they do, how they do it, and the amazing graphics they use.
Configuring YateBTS for Software Defined GSM/GPRS
Configuring YateBTS NIPC with a BladeRF Software Defined Radio
Compiling YateBTS NIPC for Software Defined GSM / GPRS
Setting up YateBTS GSM BTS in Ubuntu 18.04
Field Test on an iPhone
Accessing the Field Testing suite on an iOS Device