Port Scan Operation of the MAX11947


With the introduction of the new AISG v3.0 standard in 2019, many new use cases were implemented for antenna line communication. While these changes had little to no impact on the physical layer of operation, one systematic change was obvious: all RF connections on the cellular tower would now require an AISG communications feature for the PING function. This application note looks at the new Maxim MAX11947, an AISG modem with a 4:1 multiplexer and shows how the integrated scan feature can help system designers implement the new standards requirements with fewer components and less development overhead.


The proliferation of cellular networks and handsets throughout the world, especially over the past decade, has resulted in an exponential need for electronics to support the mobile communications infrastructure. A simultaneous demand for more bandwidth is also pushing network providers to continuously expand their coverage while increasing cell density which, in turn, has boosted the need for infrastructure hardware.

Over 15 years ago, manufacturers began to standardize interoperability of cellular radio equipment allowing more variation in assembling cellular base stations with antenna gear, amplifiers, etc. This interfacing and communication standard was first established by the Antenna Interface Standards Group (AISG) back in 2003 and 2004[1]. The AISG standard continues to evolve with market expansion. This application note introduces several features of the newest Maxim product used to meet the interoperable communications needs of today and into the future.

AISG v2.0 and the MAX9947

In 2009, Maxim Integrated introduced the first, fully integrated modem to meet the AISG v2.0 physical layer (PHY) standard[2]. The original MAX9947[3] provides a complete solution for translating between the ubiquitous RS-485 interface and a 2.176MHz OOK signal which piggybacks on the cellular band RF cable. This solution allows for a much more compact system design, space savings, decreased power consumption, and less hardware, plus the integrated modem provides the reliability of a simple, proven, factory-tested device.

The New AISG v3.0 Standard

An upgrade to the already successful standard was put forth by the AISG in 2019. This evolutionary step built upon the success of the previous generations with the intent of adding new features while maintaining the core interoperability of primaries and their managed antenna line devices (ALDs).

The new AISG v3.0 feature set includes device discovery, connection mapping, and multi-primary control. While a system designer will find the new standard to be a helpful upgrade for many higher level functions, the PHY layer remained unchanged from v2.0 to v3.0[4]. As a consequence, the original Maxim modem (MAX9947) is still fully compatible with the new AISG v3.0 standard.

Upgraded Features of the MAX11947

So why the new design?

Even though Maxim's original AISG modem remains compatible with the new standard, we felt the expanded features in the latest version provided an opportunity to improve our existing device. Therefore, we designed the new MAX11947[5] with several performance improvements and added features. As a first step, we added a digital interface to the modem along with several internal configuration registers. This new SPI control allowed for the integration of previously external features such as the power amplifier’s (PA) power bias network, now incorporated as a digitally adjustable transmit power. We included the PA output resistor to remove one more external component from the designer's bill of materials (BOM) along with another feature to match the adjustable PA power: an adjustable receive sensitivity threshold. Most importantly, the biggest feature added to the device was an integrated 4:1 port multiplexer. The new MUX effectively provides four modems in one chip and facilitates a means to scan up to four ports for a ping signal.

Why Scan?

The ability to scan multiple RF ports became prominent with the release of AISG v3.0. One goal of the new standard was to define a ping process to help map cabling connections, identifying connected primaries and secondaries, etc.

An example of how this new ping process may be implemented would be within a tower-mounted amplifier (TMA) on a cellular network system. In the example shown in Figure 1, the TMA shows four upstream connections to the antenna array and four downstream RF ports to the base station.

AISG v3.0 architectureFigure 1. AISG v3.0 architecture.

Only one MAX11947 is needed to handle communication or pings on all four upstream ports from the quad TMA to the antenna array. Another MAX11947 is used for the downstream communication to the base station and can provide pings over the three other ports as well. Each of these modems would use the 4:1 MUX to monitor four ports each, with the first looking across P1–P4 and the second available for ports P5–P8 thus requiring only two devices when previously eight would be needed to monitor and communicate over the eight RF ports.

Scanning becomes useful when the primary (base station radio) requests the antenna array to ping down the cables which are upstream from the TMA. The upstream modem on the quad TMA can listen on each of the ports for the ping signal and if that signal does not arrive at the expected port, it can quickly determine if it did arrive and at which port. This scanning ability helps to both map the hardware interconnects and find faults with the RF cabling system. The MUX on the downstream modem allows just one device to ping from any of the four RF ports to the base station connections below--completing the mapping process with fewer IC components than previously required.

Port Scanning Blocks

Two principal elements are required to search the RF ports for an active ASIG signal: 1) the ability to determine an RF port has an active carrier and 2) the ability to switch between multiple RF ports.

The first feature is native to any AISG modem. Whenever a 2.176MHz carrier is detected, the modem provides a couple of indicators of that incoming signal: with the MAX11947 both the DIR and RXOUT pins indicate incoming data.

For the second feature, our new 4:1 MUX provides the ability to connect the modem to multiple ports. With that switching ability built-in, port scanning becomes feasible.

One more feature helps to automate a scan: an internal state machine. Maxim Integrated foresaw this synergy, so we included a purpose-built finite state machine (FSM) to automate the port scanning process and lift that burden from both the developer and the MCU hardware. Registers are used to configure the state machine, allowing for a customized use of the scanning feature.

Using the Port Scan Feature

Before scan can be employed, the external hardware environment needs to be reflected in the internal port masking bits. Because the registers are volatile and lost when the supply is removed, these settings need to be programmed after power has been applied to the MAX11947.

Programming the Scan Registers

Configuring the MAX11947 for scanning is relatively straight-forward. There are essentially four registers related to the automatic port scanning system: SCAN (0x2), PINGCFG (0x4), DWELL_MULTI (0x5), and PORTSTAT (0x6). Once the device is powered up, these registers can be used in either their default configuration or can be customized.

The best place to start is with identifying which ports on the 4:1 MUX should be included in the auto scan process. This is usually defined by the hardware architecture and the FSM simply needs to know which ports to include in the sequence. By default, all four MUX ports will be checked for an AISG carrier signal (no port is masked off), and the scanning process will monitor each port, in succession, for one bit period of time, until a signal is found. To remove an RF port from the scan list, the PINGCFG (0x4) register can be changed by clearing the bit or bits related to the ports which are not to be scanned (MASK_P0 through MASK_P3).

The default data rate for the MAX11947 is set to 9600baud or 9.6kbps, accommodating the default AISG v3.0 standard. Other data rates are still supported (38.4kbps and 115.2kbps), making the MAX11947 back-compatible with earlier implementations. This baud rate also sets the DIR Dwell Time (tDWELL) and provides a baseline timer for the port scan features by defining the "bit period" (0.104ms for the 9.6kbps default setting). The time spent listening to each port can also be extended to a user-defined integer count of bit periods. Two pre-configured periods are available: 1x bit period or 16x bit periods. There are two other options available for the designer: a user-defined multiplier, which ranges from 1x to 4095x bit periods, or a manually controlled wait/index which can be shorter or longer than any of the other dwell times provided. Selecting the manual mode, 1x, 16x, and user-programmed bit periods is done by setting the SCAN_DWELL field in the SCAN (0x2) register. When selecting the user-programmable bit period, the DWELL fields (PINGCFG (0x4) and DWELL_MULT (0x5)) should be set to the desired multiplier. The DWELL fields default to an 82x multiplier which should account for the packet length of a AISG v3.0 PING signal.

Another option to "check all the RF ports" provides additional flexibility to the state machine. This forces the FSM to continue looking for a carrier signal even if one has already been detected during the scan. This option is controlled by the CHK_ALL_PORTS field in the SCAN (0x2) register. There is also a dwell time override available by clearing the FULL_DWELL field in the SCAN (0x2) register. When this field is cleared to "0", the RF port will be flagged with a detected carrier and then the state machine will immediately move to the next unmasked port in the sequence.

During the scanning process, the analog modem circuitry is fully operational and will provide a positive detection of a 2.176MHz OOK signal by setting both the DIR and RXOUT pins appropriately. Selecting the user-programmed multiplier with its default setting, would allow the modem to listen to and decode a full PING packet on each RF port.

Scanning the Ports

Initiating the scan process is very straightforward. After configuring the variables used by the FSM, the user simply sets the START_SCAN bit to "1" in the SCAN (0x2) register. This bit is self-clearing. Once the process is initiated, the FSM takes over the automated scan and runs through the flow diagram shown in Figures 2 and 3 (same as Figure 14 of the MAX11947 data sheet).

Default Scan

An example of the default port scanning flow is shown in Figure 2. The scan is initiated by setting the START_SCAN bit to "1". Following the gray flow in the diagram, the FSM will automatically set the SCANNING bit in the read-only PORTSTAT (0x6) register; it will initiate the LSTN_PORT bits to a 0 value (starting at RF port P0); the state machine will clear all the AISG_Px bits, then enter the "Port Loop". The first step in the port loop is to set the active RF port (RFPORT field in the MUX (0x1) register) to equal the LSTN_PORT value and begin the "Detection Loop" shown with the green path in Figure 2. The FSM checks the internal DIR signal to determine if a carrier is detected in the analog receiver. If there is no evidence of a carrier, the state machine will first verify that the dwell time is set to a multiplier value (versus the manual setting) and will then check if the dwell time has expired. If the timer has not yet expired, then the detection loop is repeated until a signal is detected or the dwell time expires. By default, the scan will dwell on each undetected port for 1x a bit period or 0.104ms.

Default port scanning diagramFigure 2. Default port scanning diagram.

Once a carrier is detected, the FSM will follow the orange path in Figure 2. First, it will flag the appropriate port where the signal was found, then the state machine will check that the FULL_DWELL bit is not set (default), and finally it will determine if other ports are supposed to be scanned by assessing the CHK_ALL_PORTS bit value (by default they are not).

Once an AISG signal is detected, the SCANNING bit in the PORTSTAT (0x6) register is cleared and the auto scan routine is exited.

Manual Dwell Scan

An example of a manual-dwell port scanning flow is shown in Figure 3. The scan is initiated by setting the START_SCAN bit to "1". Just like the default scan, following the gray flow in the diagram, the FSM will automatically set the SCANNING bit in the read-only PORTSTAT (0x6) register; it will initiate the LSTN_PORT bits to the value 0 (starting at RF port P0); the state machine will clear all the AISG_Px bits; then it enters the "Port Loop". After setting the active RF port the state machine begins the "Detection Loop," this time following the green path in Figure 3. As before, the FSM checks the internal DIR signal to determine if a carrier is detected in the analog receiver. If there is no evidence of a carrier and with the SCAN_DWELL bit cleared to "0" (manual mode), the state machine will next move to check the SCAN_INDEX bit in the SCAN (0x2) register. If the index has not been set, then the detection loop is repeated until either a signal is detected or the SCAN_INDEX bit is set to "1".

Manual dwell port scanning diagramFigure 3. Manual dwell port scanning diagram.

After a carrier is detected, the FSM will follow the orange path. In this example, the FULL_DWELL bit is also set to "1" giving the user exclusive control over when the scan moves to the next port. Because full dwell is set, the state machine will return to the green manual dwell loop after flagging the port where the signal was found. This process will continue to detect the carrier and return to the green loop until the carrier is no longer present, then the flow will return to just circling around the green manual dwell loop.

Once the scan is indexed, the state machine will drop down the purple path and will assess if there was a detected signal. If so, it will then evaluate if all RF ports are supposed to be scanned. In this example, the CHK_ALL_PORTS bit is set to "1", so the process will repeat through all the unmasked RF ports.

When the user has manually indexed through all the ports, the state machine will finish the port scan following the red path by clearing the SCANNING bit to "0" and exiting the manual-dwell scan routine.

With this process, the user can completely control the timing of the port scan while still automating the detection process. Given the length of a SPI transaction and the speed at which the registers can be written, the manual dwell scan can operate anywhere from a very quick dwell time to an infinite wait. To determine the fastest dwell time possible, we take the 16-bit word length for the MAX11947 interface and the SCLK frequency used (typical of 8MHz to 20MHz depending on the logic supply level), then calculate how fast the SCAN_INDEX bit can be written. Using a 5MHz SPI clock, that could be about every 3.2µs, or with a 20MHz clock, that could be about every 0.8µs. Given the use of a 2.176MHz carrier frequency and a 9.6kbps data rate, the quickest scan of all four RF ports is mostly limited by the ability to detect a carrier rather than the speed at which the state machine can be indexed.

Scanning Without the FSM

The state machine is not needed to scan through the ports. A user can simply set the RFPORT field in the MUX (0x1) register to the port of interest and then note the output of the DIR and RXOUT pins from the modem. These two pins are also mirrored by internal bits in the STATUS (0x7) register, allowing full, interactive control of the scan process through the MAX11947's SPI interface. Port connections, timing, and signal detection will need to be handled by the system designer using register read and write operations.

Identifying the Active Port

After the auto or manual-dwell port scan has completed, the active ports (RF ports with a detected AISG carrier) are identified by reading the PORTSTAT (0x6) register. A "1" in any of the lower nibble bits will indicate a detected carrier for the respective port. For example, if bit 0 (AISG_P0) was set to "1" then a carrier was detected at that port during the scan process.

An Evaluation Kit Example

By extending the dwell time on a MAX11947 evaluation kit, the user can witness the scanning process in action.

Using a MAX11947EVKIT data sheet following the Procedure section through Step 5-a. At Step 5-b-ii-3, instead of setting the Dwell Time to the "1X Bit Period", select the "User Defined Multiplier" and in the value box enter "4095" (see the note in Figure 4). This will cause a 4095-bit period delay between each port scan for a total scan time of about 2s.

Next, set the transmitter board and cable connections such that the last port of the receiver board (P3) has a valid carrier signal. As an alternative, the user can select the "Check All Unmasked Ports" in the "SCAN Mode" box which will force the state machine to listen to all ports regardless of where the carrier signal is detected (see the red box in Figure 4).

Finally, by clicking on the [Start Scan] button, the user will see each successive port's LED light-up in sequence from P0 through P3. Once the scan state machine has completed the process, the "AISG Carrier" block in the GUI will show which RF port had the detected carrier (see the note in Figure 4).

MAX11947EVKIT GUI scan setup and resultFigure 4. MAX11947EVKIT GUI scan setup and result.


  1. Standard No. AISG1: Issue 1.1 "AISG1_Issue_1.1.pdf" from https://aisg.org.uk/publications/standards/, 30 Jul 2004, © Copyright Antenna Interface Standards Group 2002-2004.
  2. Standard No. AISG v2.0, "AISG-v2.0.pdf" from https://aisg.org.uk/publications/standards/, 13 Jun 2006, © Copyright AISG Ltd 2002-2006.
  3. MAX9947 Data Sheet 19-5029 Rev 4; 4/16, "MAX9947.pdf" from www.maximintegrated.com, Apr 2016.
  4. Base Standard AISG v3.0, "Base-standard_AISG_v3_0_v3_0_0_10.pdf" from https://aisg.org.uk/publications/standards/, 5 Nov 2018, © Copyright AISG Ltd 2016-2018.
  5. MAX11947 Data Sheet 19-100411; Rev 0; 2/20, "MAX11947.pdf" from www.maximintegrated.com, Feb 2020.