A battered 868 MHz ISM railway modem from Polish company ISM gets a full teardown, with an RJ45 socket and a BNC antenna connector.
Inside, separate power and digital boards use LM2575S converters and SP485E transceivers, and the RJ45 carries power plus RS-485, not Ethernet.
The main MCU is a 32-bit H8/3052 Renesas with 512 KB ROM and 8 KM RAM, plus BS62LV1027 memory, SP706SE supervision, and 24C04WP EEPROMs.
Powering it up lights the red LED briefly, then the display counts from 1 to 9 and back to 0 while the green LED stays on.
No documentation survives, the RF module has no markings, and the communication protocol remains unknown.
Another interesting piece of equipment from the liquidation - an 868 MHz ISM modem. Also badly battered this time, but perhaps worth a look inside anyway? Already from the casing it is interesting - I don't see a power connector, there is only an RJ45 socket. Could we have PoE here, or maybe someone just used the connector in their own way?
Apart from that we only have a BNC antenna connector:
We take a look inside.
There are two boards inside - the main board and separately the RF module. The main board has a clearly visible separate power section and a separate digital section with display, switches and RS232 connector for the service technician.
On the input we have status LEDs, and just behind them you can see the PTC protection thermistors. With the RJ45 connector actually goes the power and communication, a little further on we have a dual power section with voltage reduction inverters.
This section is based on two LM2575S, one probably generating a voltage of 5 V and the other 3.3 V or similar.
Right next to it are two SP485Es - these are RS-485 half-duplex transceivers. This explains what standard the communication is in. It is not Ethernet, however.
The main microcontroller is a 32-bit H8/3052 made by Renesas with 512 KB ROM and 8 KM RAM. Next to it I see a BS62LV1027 128 KB memory. Nearby is the SP706SE, which is a supervisory circuit (watchdog and voltage monitor).
Next we have the RS232 service connector along with a TTL to RS232 converter (ST232C), DIP switches and a 7-segment service display. the 74HC14D is a Schmitt flip-flop (buffer) and the HC00G is a NAND gate circuit.
Under the RF module is there room for some more circuitry - memory? Or is it for a module in surface mount format?
The underside of the PCB:
Here, as standard for this type of module, two 24C04WP EEPROM memory bones:
Plus a 74HC165D sliding register - perhaps to control this display?
For the RF module itself, I don't know what I can write, there are no markings on the circuitry, is anyone able to identify it?
I connected the power supply. The red LED lights up for a moment. The display quickly counts down from 1 to 9, ending with zero again. The green LED stays lit.
Basically that's it. I have no documentation for this device. Potentially a USB to UART or RS485 converter could be attempted, but without knowledge of the protocol I would be unlikely to expect much. Have you encountered any modules of this type? Feel free to comment.
PS: How do I know "railroaded"? Unconfirmed information from the parts donor.
About Author
p.kaczmarek2 wrote 14221 posts with
rating 12114 , helped 647 times.
Been with us since 2014 year.
This is a regular RS232/RS485 modem -> radio. The RJ45 is not the ethernet but the RX/TX signals and the power supply for the device are output there. A similar product is e.g. the Camsat CD-01 for... [Read more]
aadeer
04 Feb 2026 22:58
What is the display used for? Diagnostics, setting the address? It's probably in all those modules you showed. [Read more]
p.kaczmarek2
04 Feb 2026 23:12
From what I have tested, it counts down when power is applied, and in one of the faulty modules (if I remember correctly) it stopped at a different digit, which to me suggested an error code. [Read more]
saly
05 Feb 2026 15:59
I think it's a device that communicates the SIP (passenger information system) to the world. [Read more]
FAQ
TL;DR: A teardown shows two LM2575S buck converters and a radio-linked RS232/RS485 interface; “power and communication go via RJ45.” [Elektroda, p.kaczmarek2, post #21828581]
Why it matters: This FAQ helps repairers and integrators identify power, I/O, and basic behavior to bench-test or repurpose the 868 MHz ISM modem.
It’s a serial‑to‑radio modem: RS232/RS485 on the RJ45 side, 868 MHz RF on the BNC side. You feed it serial data and DC power through RJ45; it transmits over the ISM band to a paired unit. It’s not an Ethernet device. [Elektroda, dktr, post #21828795]
Is the RJ45 port Ethernet or PoE?
Neither. The RJ45 is a convenient connector carrying RX/TX serial lines and DC power for the modem. There is no Ethernet PHY, and it is not 802.3af/at PoE. “RJ45 is not the ethernet” here. [Elektroda, dktr, post #21828795]
Which chips are on the board?
Notable parts include two LM2575S regulators, two SP485E RS‑485 transceivers, Renesas H8/3052 MCU, BS62LV1027 128 KB memory, SP706SE supervisor, ST232C level shifter, two 24C04WP EEPROMs, 74HC165D shift register, plus a separate unmarked RF module. [Elektroda, p.kaczmarek2, post #21828581]
What does the 7‑segment display indicate?
On power‑up it counts 1→9 and returns to 0. In at least one faulty unit it stopped at a different digit, suggesting an error code. “It counts down when power is applied.” That behavior helps quick diagnostics. [Elektroda, p.kaczmarek2, post #21829425]
How do I safely power and talk to the unit?
Trace RJ45 pins to PTCs and buck converters to identify power pairs.
Feed a current‑limited bench supply and confirm the startup count on the display.
Connect RS‑232 service port or RS‑485 via USB adapters to probe traffic.
Without protocol docs, expect limited interaction. [Elektroda, p.kaczmarek2, post #21828581]
Is there any Ethernet hardware on the PCB?
No. The teardown and comment confirm serial transceivers (SP485E) and a service RS‑232 port, but no Ethernet magnetics or PHY. Communication is RS232/RS485 over RJ45. [Elektroda, dktr, post #21828795]
Could this be part of a railway Passenger Information System (SIP)?
A forum member suggested it interfaces a SIP (passenger information) subsystem to the outside world. That’s plausible for 868 MHz telemetry, but remains unconfirmed without OEM docs or labels. [Elektroda, saly, post #21829917]
What is RS‑485 in this context?
RS‑485 is a differential, half‑duplex serial bus suitable for multi‑drop wiring and noise‑prone environments. This board hosts two SP485E transceivers to interface that bus through the RJ45. [Elektroda, p.kaczmarek2, post #21828581]
What kind of range should I expect at 868 MHz?
Expect short‑to‑medium range typical of low‑power ISM telemetry; actual distance depends on output power, antenna, and clutter. This unit presents a BNC for a proper external antenna, improving link budget versus PCB whips. [Elektroda, p.kaczmarek2, post #21828581]
Does the module expose a service interface for configuration?
Yes. There’s an RS‑232 service connector, DIP switches, and a 7‑segment display for status. Without protocol documentation, you may need to sniff serial frames and map DIP functions experimentally. [Elektroda, p.kaczmarek2, post #21828581]
Any known failure or edge‑case behavior to watch for?
One reported unit halted the startup count on a non‑zero digit, implying an internal fault code. If the display doesn’t finish 1→9→0, log the halt value before power‑cycling. That pattern can guide board‑level checks. [Elektroda, p.kaczmarek2, post #21829425]
Who made the RF submodule, and can I identify it?
The RF mezzanine lacks markings in the shared photos. Without part codes or silkscreen, identification requires RF probing or desoldering for die/package marks. No OEM name appears on the RF can. [Elektroda, p.kaczmarek2, post #21828581]
How can I test RS‑232 vs RS‑485 quickly?
Use the RS‑232 service header first for console‑style output. For field I/O on RJ45, connect a USB‑RS485 dongle and watch for half‑duplex traffic during the 1→9→0 boot window. Keep termination off until frames appear. [Elektroda, p.kaczmarek2, post #21828581]
Can I assume the input voltage from the presence of LM2575S regulators?
No. LM2575S supports wide inputs, and railway gear varies. Identify RJ45 power pairs and trace to PTCs and regulators. Then ramp a current‑limited supply while monitoring draw and display sequence. [Elektroda, p.kaczmarek2, post #21828581]
Is there any indicator LED behavior worth noting?
On power‑up, the red LED lights briefly; the green LED then stays on while the display cycles 1→9→0. Record deviations for troubleshooting. That repeatable sequence is a useful baseline statistic. [Elektroda, p.kaczmarek2, post #21828581]
Comments
This is a regular RS232/RS485 modem -> radio. The RJ45 is not the ethernet but the RX/TX signals and the power supply for the device are output there. A similar product is e.g. the Camsat CD-01 for... [Read more]
What is the display used for? Diagnostics, setting the address? It's probably in all those modules you showed. [Read more]
From what I have tested, it counts down when power is applied, and in one of the faulty modules (if I remember correctly) it stopped at a different digit, which to me suggested an error code. [Read more]
I think it's a device that communicates the SIP (passenger information system) to the world. [Read more]