Cellular Network Infrastructure » Radio Access Network » OsmoBSC

{{>toc}}

h1. The HSL 2.75G Femtocell

The HSL 2.75G Femtocell is a relatively recent product implementing a single-ARFCN BTS with 23dBm maximum output power.

*NOTE: All information on this website is gathered on our own, without any cooperation of the manufacturer.  There is no guarantee of correctness.  There is no relationship between HSL and the [[OpenBSC]] project developers!

*Due to hostile reaction from HSL, there is currently no interest in maintaining support for this BTS model

h2. Hardware

The hardware seems to be a much more software radio approach than the nanoBTS, which are

built from telephone baseband processors.

* Ti [[DaVinci]] TMS320DM6443A (ARM9 CPU + DSP)

* Xilinx Spartan-3A FPGA (XC3SD1800A)

* 128 MByte DDR-2 RAM

* 128 MByte NAND flash

* Realtek RTL8201 Ethernet MAC

* Dual 12-bit 65Ms/sec ADC (ADS5232)

* Dual 14-bit 275Ms/sec DAC (DAC5672)

As you can see, the hardware is _much_ more powerful than you would ever

need for a simple single-ARFCN femtocell.  Using the high-speed DAC/ADC,

the combined power of the FPGA (with DSP slices) and DSP, you can probably

expect that they will at least want to do multi-ARFCN (if not 3G) on the

same hardware at some later point.

There's a dedicated [[HSL_FemtoHardware]] page with more details.

h3. Serial Port

There's a real RS232 port (+/-12V levels) on JP1. Only Rxd, Txd and GND are present.

In order to enable the [[DaVinci]] UART boot mode, you need to place 1kOhm (0603 sized) resistors on the unpopulated

footprints of R28 and R29.  You will get "BOOTME BOOTME BOOTME ..." on the UART at 115200, from whihc point on

you can use the DVFlasher tool of TI.

h2. Protocol

They use an odd down-sized minimalistic dialect of the ip.access Abis/IP.

h3. ACS

Prior to connecting to the BSC, the cell downloads its current configuration

via https, using a HTTP POST of its serial number.

h3. IPA layer

The IPA multiplex layer does not have PING/PONG keepalives, and it does

not do the ID_GET/ID_RESP/ID_CONF identification with the Unit ID.

Furthermore, both OML and RSL are encapsulated in the same TCP connection.

Stream identifier 0xDD is used for passing string debug messages from the

BTS to the BSC.

Neither OML nor RSL are implemented fully, as per 12.21 / 08.58

h3. RSL

It seems to have a very 'creative' interpretation of the RSL specification.  Some

examples:

* use of SACCH INFO MODIFY instead of SACCH FILLING for default SI5/SI6

* it forgets to send RSL CHAN REL ACK on TS1...7

* it does not implement RSL CHAN MODIFY

* it seems to be unable to run without DTX

* it often detects RACH requests where there are none (!)

h3. OML

OML is almost not present at all.  Only software download and setting of

ARFCN + BSIC are supported.  No managed objects, no state transitions, no

software activation procedures/events at all.

The configuration of each timeslot seems to happen 'on demand', i.e.

there are no OML commands to configure the timeslots, but it depends on your

RSL CHAN ACT whether a timeslot will become a TCH/H or TCH/F.

I have not managed to use a SDCCH/8 anywhere, just TCH/F and TCH/H as well as

SDCCH/4.

The BCCH _claims_ to be a Combination 4, but in reality it is a Combination 5

(i.e. including the SDCCH/4)

h3. RTP

There is a proprietary RSL message used to connect the BTS to the TRAU.

Codec data is exchanged by RTP packets exchanged between BTS UDP port 1000 and the

TRAU IP and UDP port.

The [[CellID]] is used as SSRC of all RTP packets, enabling the TRAU to distinguish frames

from different cells

If multiple TCH are active, the RTP payload contains the codec frames from all active TCH

channels.  The format is like a sequence of elements formatted like this:

* byte 1: RSL Channel number (e.g. 0x09 = TCH/F on TS 1)

* byte 2: length of codec frame (e.g. 0x22 hex for EFR)

* byte 3..length: Codec Data

h3. GPRS

GPRS is quiite odd, too.  The BSSGP is encapsulated in the RSL L3_INFO_IE,

this means we will have to run a NS link from the BSC to the SGSN, combining

all the BSSGP links from HSL Femtocells to the BSC.

h2. Software support

h3. wireshark

We have some wireshark patches for adding HSL RSL/OML support:

* http://cgit.osmocom.org/cgit/openbsc/plain/wireshark/0005-rsl-hsl.patch

* http://cgit.osmocom.org/cgit/openbsc/plain/wireshark/0006-abis_oml-hsl.patch

h3. [[OpenBSC]]

<pre>

* http://cgit.osmocom.org/cgit/openbsc/log/?h=laforge/hsl