The HSL 2.75G Femtocell

The HSL 2.75G Femtocell is a relatively recent product implementing a single-ARFCN BTS with 23dBm maximum output power.

*NOTE: All information on this website is gathered on our own, without any cooperation of the manufacturer. There is no guarantee of correctness. There is no relationship between HSL and the OpenBSC project developers!

Due to hostile reaction from HSL, there is currently no interest in maintaining support for this BTS model


The hardware seems to be a much more software radio approach than the nanoBTS, which are
built from telephone baseband processors.

  • Ti DaVinci TMS320DM6443A (ARM9 CPU + DSP)
  • Xilinx Spartan-3A FPGA (XC3SD1800A)
  • 128 MByte DDR-2 RAM
  • 128 MByte NAND flash
  • Realtek RTL8201 Ethernet MAC
  • Dual 12-bit 65Ms/sec ADC (ADS5232)
  • Dual 14-bit 275Ms/sec DAC (DAC5672)

As you can see, the hardware is much more powerful than you would ever
need for a simple single-ARFCN femtocell. Using the high-speed DAC/ADC,
the combined power of the FPGA (with DSP slices) and DSP, you can probably
expect that they will at least want to do multi-ARFCN (if not 3G) on the
same hardware at some later point.

There's a dedicated HSL_FemtoHardware page with more details.

Serial Port

There's a real RS232 port (+/-12V levels) on JP1. Only Rxd, Txd and GND are present.

In order to enable the DaVinci UART boot mode, you need to place 1kOhm (0603 sized) resistors on the unpopulated
footprints of R28 and R29. You will get "BOOTME BOOTME BOOTME ..." on the UART at 115200, from whihc point on
you can use the DVFlasher tool of TI.


They use an odd down-sized minimalistic dialect of the ip.access Abis/IP.


Prior to connecting to the BSC, the cell downloads its current configuration
via https, using a HTTP POST of its serial number.

IPA layer

The IPA multiplex layer does not have PING/PONG keepalives, and it does
not do the ID_GET/ID_RESP/ID_CONF identification with the Unit ID.
Furthermore, both OML and RSL are encapsulated in the same TCP connection.

Stream identifier 0xDD is used for passing string debug messages from the
BTS to the BSC.

Neither OML nor RSL are implemented fully, as per 12.21 / 08.58


It seems to have a very 'creative' interpretation of the RSL specification. Some
  • use of SACCH INFO MODIFY instead of SACCH FILLING for default SI5/SI6
  • it forgets to send RSL CHAN REL ACK on TS1...7
  • it does not implement RSL CHAN MODIFY
  • it seems to be unable to run without DTX
  • it often detects RACH requests where there are none (!)


OML is almost not present at all. Only software download and setting of
ARFCN + BSIC are supported. No managed objects, no state transitions, no
software activation procedures/events at all.

The configuration of each timeslot seems to happen 'on demand', i.e.
there are no OML commands to configure the timeslots, but it depends on your
RSL CHAN ACT whether a timeslot will become a TCH/H or TCH/F.

I have not managed to use a SDCCH/8 anywhere, just TCH/F and TCH/H as well as

The BCCH claims to be a Combination 4, but in reality it is a Combination 5
(i.e. including the SDCCH/4)


There is a proprietary RSL message used to connect the BTS to the TRAU.

Codec data is exchanged by RTP packets exchanged between BTS UDP port 1000 and the
TRAU IP and UDP port.

The CellID is used as SSRC of all RTP packets, enabling the TRAU to distinguish frames
from different cells

If multiple TCH are active, the RTP payload contains the codec frames from all active TCH
channels. The format is like a sequence of elements formatted like this:
  • byte 1: RSL Channel number (e.g. 0x09 = TCH/F on TS 1)
  • byte 2: length of codec frame (e.g. 0x22 hex for EFR)
  • byte 3..length: Codec Data


GPRS is quiite odd, too. The BSSGP is encapsulated in the RSL L3_INFO_IE,
this means we will have to run a NS link from the BSC to the SGSN, combining
all the BSSGP links from HSL Femtocells to the BSC.

Software support


We have some wireshark patches for adding HSL RSL/OML support: