A peek under the radome of 32×32 5G Active Antenna Unit
Tag Archives: RAN
Huawei BTS3900 – MML Basics
Learning Huawei’s flavour of MML – Man Machine Language for the BTS 3900 series Macro Base Stations.
My used Huawei BTS3900 LTE RAN Adventure – The Impulse Purchase
Meta: The Australian government made up it’s mind some time ago that Huawei would be blacklisted from providing equipment for 5G networks.
Several other countries have adopted the same policy in regards, and as such, deployed Huawei tech is being replaced, and some of it filters down to online auction sites…
So I kind of purchased an item described as “Huawei BBU3900” with a handful of unknown cards and 2 LRFU units, for just over $100.
My current lab setup is a single commercial picocell and a draw of SDR hardware that works with mixed results, so the idea of having a commercial macro cell to play with seemed like a great idea, I put lowball offer in and the seller accepted.
Now would be a good time to point out I don’t know much about RAN and it’s been a long time since I’ve been working on power systems, so this is shaping up to be a fun project.
Photo from the listing Photo from the listing
I did a Huawei RAN course years ago and remembered the rough ingredients required for LTE:
- You needed either RRUs (Remote Radio Units) or RFUs (Radio Frequency Units) to handle the RF side of things.
RRUs are designed for outdoor use (such as mounting on the tower) and RFUs are designed for indoor use, like mounting in a cabinet.
I’ve ended up with two LRFUe units, which I can join together for 2x MIMO, operate on Band 28 and can put out a whopping 80W of transmit power, yes I’m going to need some big attenuators… - You need a Baseband Processor card to tell the Radio units what do do.
The card connects the CPRIs (Typically optic fiber links) between the radio units and the baseband.
The chassis I purchased came with a stack of WBBP (For WCDMA) cards and a single LBBP card for LTE. The LBBP card has 6 SFP ports for the CPRI interfaces, which is more than enough for my little lab. (You can also daisy-chain CPRIs so I’m not even limited to 6 Radio Units.) - You need a backplane and a place for the cards to live – this is the BBU3900 chassis. It’s got basic switching to allow communication between cards, a chassis to distribute power and cooling.
(Unlike the Ericson units there is actually a backplane for communications in the Huawei chassis – the Ericsson RBS series has is just power and cooling in the chassis) - Optional – Dedicated transmission card, I’ve ended up with a Universal Transmission Processor (UTRP9) with 2x Gig Ethernet and 2x Fast Ethernet ports for transmission. This will only work for GSM and UMTS though, not LTE, so not much use for me.
- You need something to handle main processing (LTE / Universal Main Processing and Transmission Unit (LMPT / UMPT)).
Unfortunately the unit I’ve ended up with only came with a WMPT (For WCDMA), so back online to find either an LMPT (LTE) or UMPT (Universal (2G/3G/4G))… - You need a Universal Power and Environment Module (UPEU) to power up the chassis and handle external IO for things like temperature alarms, door sensors and fire detectors. This chassis has two for redundancy / extra IO & extra power capacity.
So in order to get this running I still need quite a few components:
- Attenuators – I’ll be able to turn the power down, sure, but not to the levels required to be legal.
- Antennas – These are FDD units, so I’ll need two antennas for each RFU, on Band 28
- Feeder Cables – To connect the antennas
- SMF cables and SFPs – I’ve got a pile in my toolbox, but I’ll need to work out what’s supported by these units
- A big -48vDC rectifier (I got the BBU3900 unit powered up with an existing supply I had, but I’m going to need something bigger for the power hungry RFUs)
- DC Distribution Unit – Something to split the DC between the RFUs and the BBU, and protect against overload / short
- USB-Network adapter – For OAM access to the unit – Found these cheaply online and got one on the way
- The LTE Main Processing & Transmission (LMPT) card – Ordered a second hand one from another seller
I powered up the BTA3900 and sniffed the traffic, and can see it trying to reach an RNC.
Unfortunately with no open source RNC options I won’t be posting much on the topic of UMTS or getting the UMTS/WCDMA side of things on the air anytime soon…
So that’s the start of the adventure.
I don’t know if I’ll get this all working, but I’m learning a lot in the process, and that’s all that really matters…
Note: I think this is the course I did from Huawei on the BBU3900…
GSM with Osmocom: SS7 & Sigtran
SS7 Basics and Osmo-STP as a Signaling Transfer Point
GSM with Osmocom: NanoBTS
Setting up ipaccess NanoBTS on Osmocom’s OsmoBSC
GSM with Osmocom: Call routing in GSM
How call routing in GSM works and it’s application in the Osmocom suite
GSM with Osmocom Part 9: Calls & SMS at last!
So now we’ve covered the basics of what’s involved let’s get some traffic on our network. For starters we’ll need to start each of our network elements and bring up whichever BTS hardware we’re using. In order for our calls to have audio, we’ll need to set a parameter on the Media Gateway. We’ll cover … Continue reading GSM with Osmocom Part 9: Calls & SMS at last!
GSM with Osmocom Part 8: The Mobile Switching Center
Setting up the Mobile Switching Centre for a GSM network using OsmoMSC.
GSM with Osmocom Part 7: The HLR – Home Location Register (and Friends)
What the Home Location Register (HLR) does in GSM, how to set it up and configure subscribers.
GSM with Osmocom Part 6: Integrating our LimeSDR BTS with OsmoBSC
Connecting our LimeSDR based GSM BTS with OsmoBSC.
GSM with Osmocom Part 5: Software BTS with LimeSDR & osmo-bts-trx
Using a LimeSDR as a GSM BTS with Osmocom.
GSM with Osmocom Part 4: The Base Station Controller (BSC)
Configuring a GSM Base Station Controller with Osmocom stack.
GSM with Osmocom Part 3: Introduction to Osmo Software & Virtual BTS
Setting up a virtual BTS in our BSC with Osmocom.
GSM with Osmocom Part 2: BTS Basics
What’s a BTS and where do they fit into the GSM Network architecture?
GSM with Osmocom Part 1: Intro
Intro to our post series on GSM using the Osmocom stack,
Roll your own USIMs for Private LTE Networks
Adventures in getting USIMs to use on private LTE networks.
LTE (4G) – TMSI & GUTI
We’ve already touched on how subscribers are authenticated to the network, how the network is authenticated to subscribers and how the key hierarchy works for encryption of user data and control plane data. If the IMSI was broadcast in the clear over the air, anyone listening would have the unique identifier of the subscriber nearby … Continue reading LTE (4G) – TMSI & GUTI
LTE (4G) – EUTRAN – Key Distribution and Hierarchy
We’ve talked a bit in the past few posts about keys, K and all it’s derivatives, such as Kenc, Kint, etc. Each of these is derived from our single secret key K, known only to the HSS and the USIM. To minimise the load on the HSS, the HSS transfers some of the key management … Continue reading LTE (4G) – EUTRAN – Key Distribution and Hierarchy
LTE (4G) – Ciphering & Integrity of Messages
We’ve already touched on how subscribers are authenticated to the network, how the network is authenticated to subscribers. Those functions are done “in the clear” meaning anyone listening can get a copy of the data transmitted, and responses could be spoofed or faked. To prevent this, we want to ensure the data is ciphered (encrypted) … Continue reading LTE (4G) – Ciphering & Integrity of Messages
LTE (4G) – Authenticating the Network
How LTE Subscriber authenticate the network