Back in 2009 my wife and I bought iPhones. We had just come from Japan where smart phones had not yet penetrated the market, and were curious about the devices. At the time, only AT&T had iPhones, so we had to sign up for the AT&T network. Where we lived, however, we could not get any cellular reception indoor. In March 2011, with about six months left on our contract, AT&T sent us a femtocell so that we could use our phones in the home. It was free, and we only had to return it if we did not keep AT&T service for two years. It has been 4 years now, so I think it is about time I retire it–with a tear down!
Note: While this device certainly helped with cellular reception, and we could use our phones anywhere in our two-floor townhouse at the time, it was a bandwidth hog on our Internet connection! We ended up unhooking the femtocell because Skype calls had terrible performance on our regular PCs. When the femtocell was removed, the Skype calls were flawless and picture-perfect. So in the end we did not end up using this device! (In hindsight I wish I would have debugged and troubleshooted the device a bit more, but I just did not have the time.)
The Femtocell
The specific femtocell is actually a product called Cisco’s AT&T Microcell Wireless Cell Signal Booster Tower. I personally was a fan of the design, I thought it was aesthetically pleasing.
Let’s get straight to the tear down. After ripping apart the casing, which was not easy to remove, the following circuit board is revealed.
The top-left is a digital part of the circuit board. Some sort of device, no doubt some form of a processor, is under the heat sink. To its left are two Samsung memory chips. I was not sure what the square IC to the southwest of the processor was. In the center-top is a Spartan 3 FPGA, and to the right of that is the shielded RF circuitry. Directly below the heat-sink IC is a bunch of power regulation circuit. At the very bottom is the power input and two Ethernet jacks. The bottom right side has three ICs, and a shielded IC with a yellow labeling. Directly below it is the external antenna input. Also in that area are a large circular capacitor and a ceramic device coming off of the circuit board.
Close up of the The ceramic device and the capacitor – turns out that the ceramic device is a GPS antenna.
I popped the yellow cover off of the shielded IC, and it revealed the above. This circuit is on its own PCB which is mounted to the main PCB, and it has it owns oscillator and other off-chip components. Finally, following are some close-ups of the large shielded RF circuitry.
There are three shielded components. The top part with three different ICs, the bottom right, with an oscillator, and the bottom left, which an IC that is so small I cannot make it out. It is interesting to note also the two PCB micorstrip antennas feeding into the larger of the shielded areas, which are home to the transmitter and receiver RFICs.
A closer look at the transmitter (left) and receiver (right). Note all of the exposed copper and vias! I love RF circuits!
Interesting Parts
- MAXIM 2597 – UMTS transmitter RFIC: complete with DAC, filters, modulators, Power Ampflier, etc.
- MAX2557 – UMTS receiver RFIC: ADC, filters, demodulation, etc.
- HFIO20190630 – ???
- Picochip PC202 Picoarray – multicore digital signal processing chip
- Samsung K4T51163QG – 512 MB DDR2 SDRAM
- Spansion GL512P – 512-Mbit Flash memory
- Ralink RT2150F – Ethernet MAC and 802.11 radio (most likely only the Ethernet MAC is used)
- MXT102144 – ???
- Winbond W9812G6JH-6 – 128-Mbit SDRAM
- SiRF GSC3/LPx – GSM/GPRS and GSM IC
- SMSC 8700C – Ethernet PHY
- Xilinx Spartan-3 – FPGA that most likely glues everything together
The most interesting device in this femtocell is the Picochip PC202. The company was as fabless start-up that was bought out a decade ago. A quick search did not turn up any data sheets or processor guides for the PC202. All in all though, a very cool circuit board with lots of capability!
Further Reading on hacking the board: fail0verflow.