FreeCalypso > hg > freecalypso-docs

comparison CMU200-maintenance-notes @ 83:a87d9ee278fb

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
CMU200-maintenance-notes: new article
author Mychaela Falconia <falcon@freecalypso.org>
date Thu, 13 Jan 2022 08:18:03 +0000
parents
children d2fef140ed53
comparison
equal deleted inserted replaced
82:e279a924f7a3 83:a87d9ee278fb
1 Rohde & Schwarz CMU200 instrument is an absolutely essential piece of test
2 equipment for anyone in the business (or hobby) of designing and building his
3 or her own personal cellphones of 2G and/or 3G variety. I (Mother Mychaela)
4 currently only work with GSM, but depending on installed hw and sw options,
5 CMU200 instruments also support AMPS, IS-136, IS-95 (CDMA 2G) and both WCDMA
6 and CDMA2000 varieties of 3G.
7
8 Over the course of owning and maintaining a CMU200 instrument since 2017 and
9 having had to repair it twice now (as of 2022-01), and having conversed with
10 another CMU200 owner who had to repair his instrument in the same way, I
11 started observing a pattern in that many of these instruments are now failing
12 in the field in exactly the same ways. All of these failures happen in the
13 RXTX board, and the purpose of this article is to educate other CMU instrument
14 owners about these failures and most importantly, how to repair them.
15
16 Credit attribution
17 ==================
18
19 I sincerely thank Michael Katzmann, NV3Z / VK2BEA / G4NYV, for his invaluable
20 help in reverse-engineering the insides of the culprit RXTX board, identifying
21 various critical components on that board, including the ones that habitally
22 fail, and identifying Eccosorb-caused galvanic corrosion as the root cause of
23 these failures. Without his help, I would not have made it this far!
24
25 What is this RXTX board
26 =======================
27
28 This board is common among CMU200, CMU300 and CRTU-RU instruments from R&S - or
29 at least these are the ones I know - maybe there are others I don't know about.
30 This board encapsulates the instrument's main RF Rx and Tx chains: on the Rx
31 side it takes RF input from the front end and performs triple IF downconversion
32 to 10.7 MHz IF3, and on the Tx side it takes 13.85 MHz IF3 input and upconverts
33 it to RF output, going through IF2 and IF1 in the process - triple IF in both
34 directions.
35
36 Every CMU200 instrument always has one RXTX board - it is an absolutely required
37 component irrespective of option configurations. The hardware architecture of
38 this instrument also has a place for an optional second RXTX board, providing a
39 complete second Rx and Tx channel - however, as far as I can tell, CMU200
40 software won't do anything with it, i.e., there are no test modes or
41 applications in CMU200 software repertoire that can make use of a second RXTX
42 board. Instead it seems that configurations with two RXTX boards are better
43 supported on the CRTU-RU platform - but I know next to nothing about that one.
44
45 Also note: if your CMU200 is equipped with Aux Tx model B96 (as opposed to B95),
46 there is an output from that B96 add-on that goes to the front end input that
47 was originally meant for second RXTX.
48
49 RXTX board failures
50 ===================
51
52 In terms of externally visible symptoms, almost all CMU200 units are now failing
53 in the same ways:
54
55 1) If Tx side fails, the visible symptom is completely absent or extremely weak
56 output, and the internal loopback test fails with no signal detected at any of
57 the frequencies in the test sequence. A key point is that this failure mode is
58 independent of the selected output frequency.
59
60 2) If Rx side fails, different frequency ranges are affected differently. As I
61 shall explain momentarily, there are two different IF1 Rx paths inside the RXTX
62 board: one handles the frequency range from > 1200 to <= 2200 MHz, and the other
63 handles lower (<= 1200 MHz) and higher (> 2200 MHz) input frequencies. When a
64 given RXTX board develops Rx path failure, this failure happens separately in
65 each of these two IF1 Rx paths. The resulting symptoms vary: if only one of
66 the two IF1 Rx paths fails, then only that frequency range will be affected,
67 or if both fail, the observed loss will typically be different between the two
68 frequency ranges. The failure symptom is unexpected large attenuation:
69 sometimes around 5 to 6 dB of loss, othertimes as much as 25 dB of loss.
70
71 RXTX board architecture explained
72 =================================
73
74 Unfortunately R&S' official service manual for CMU200 instruments is only a part
75 swapper guide: it tells you which boards do what in general terms and tells you
76 how to remove and replace each part, but no schematics, and no detailed
77 explanation of what happens inside each board. However, I draw the reader to
78 the block diagram on page 3.2 of this manual - this block diagram does provide
79 an important starting point for understanding what happens inside the RXTX
80 board.
81
82 In the Tx direction, 13.85 MHz IF3 comes in from the digital board - or from
83 B68 board in WCDMA test modes. This Tx IF3 is mixed with Tx LO3 to produce
84 Tx IF2. This Tx IF2 is fixed at 487.52 MHz, thus one would think that Tx LO3
85 frequency ought to be fixed as well - but it seems to be a synthesized variable
86 frequency. (Remember, all of this understanding is from reverse engineering,
87 hence we can only figure out so much.)
88
89 Tx IF2 of 487.52 MHz is then passed through a pair of identical SAW filters,
90 Sawtek 855272 - two cascaded identical filters, with an amplifier in between.
91 This SAW filter has a center frequency of 479.75 MHz with 20 MHz bandwidth,
92 thus the passband spans from 469.75 to 489.75 MHz. Notice how Tx IF2 of
93 487.52 MHz stands just 2.23 MHz away from the edge of the passband - is it
94 intentional? What are they filtering? Without original design notes, we can
95 only guess. As I shall explain later in this article, one of these two Tx IF2
96 SAW filters is a component prone to failure.
97
98 After these cascaded SAW filters, Tx IF2 is mixed with LO2. Unlike LO1 and LO3,
99 there is only one LO2 for both Rx and Tx, and it is fixed at 1329.6 MHz. When
100 Tx IF2 at fixed 487.52 MHz is mixed with LO2 at fixed 1329.6 MHz, the output of
101 this mixer will always contain two frequencies: 842.08 MHz and 1817.12 MHz.
102 These are the two possible Tx IF1 frequencies, and there is a frequency-
103 selective filter for each of these two Tx IF1 modes. Based on the final output
104 frequency to be generated, instrument control software selects either low or
105 high Tx IF1, controlling switches before and/or after the filters. I have not
106 investigated to see if the frequency ranges for high vs. low Tx IF1 are the same
107 as on the Rx side or not - maybe they are the same, maybe they are different.
108
109 After Tx IF1 output is combined or switched from the two filters, it is mixed
110 with Tx LO1 to produce the final RF output. The mixer that does this job is
111 MACOM SM4T, which is one of the larger, prominently visible components on the
112 board. There also seems to be a fourth mixer and LO stage that kicks in only
113 for frequencies above 2200 MHz, but I haven't really studied that one as my main
114 interest is in the classic cellular frequency bands, 1900 MHz and below.
115
116 On the Rx side the same process happens in reverse, but the specific frequencies
117 used for IF1, IF2 and IF3 are slightly different. At first there is a stage
118 that only kicks in for frequencies above 2200 MHz (bypassed otherwise), and
119 then there is an SM4T mixer (identical to the one on Tx side) that takes in RF
120 and Rx LO1 to produce Rx IF1. High-side injection is used, i.e., Rx LO1 is
121 programmed to generate frequency equal to the external RF of interest PLUS the
122 desired Rx IF1 output.
123
124 Rx LO1 is programmed as follows by the instrument control software:
125
126 * Rx IF1 will be at 1816.115 MHz (call it high) if the listening frequency is
127 <= 1200 MHz or > 2200 MHz;
128
129 * Rx IF1 will be at 843.085 MHz (call it low) if the listening frequency is in
130 the intermediate range, i.e., 1200 MHz < RF <= 2200 MHz.
131
132 In addition to programming Rx LO1 to produce the desired IF1 per the logic
133 above, the software also controls switches that select one or the other IF1
134 filter: either the filter that passes low IF1 or the one that passes high IF1.
135
136 The filters used for low and high IF1 modes are the same on both Rx and Tx
137 sides. (The actual frequencies are slightly different, but in each case they
138 fit within the passband of the common filter parts.) The filter for low IF1 is
139 Murata DFC3R836P025HHD, package marking 836 CD, and the one for high IF1 is
140 DFC31R84P075HHA, package marking CR. The two filter packages are NOT the same
141 mechanically: the low IF1 filter is physically larger. Both parts are ceramic
142 monoblock filters from the same family, and it seems that these filter parts
143 were originally made for mobile phones, not for RF metrology instruments: the
144 "836 CD" filter is for AMPS uplink band, and the "CR" filter is for DCS downlink
145 band.
146
147 On the Tx side of the board there are only two IF1 filters: one for low Tx IF1
148 and one for high Tx IF1. However, on the Rx side there are 3 of these ceramic
149 filters in total: two for high IF1 (two cascaded identical filters with an
150 amplifier in between) and just one for low IF1. Why am I covering these filters
151 in so much detail? You probably guessed it: they are components that fail, as
152 will be covered shortly.
153
154 After the selection of either low or high IF1 filter, Rx IF1 coming out of the
155 selected filter (either 843.085 MHz or 1816.115 MHz) is mixed with LO2, which is
156 shared between Rx and Tx sides and fixed at 1329.6 MHz. The output of this
157 mixer is Rx IF2 at 486.515 MHz. This Rx IF2 then passes through a pair of
158 cascaded Sawtek 855272 filters, two identical filters with an amplifier in
159 between, exactly the same as on the Tx side. Then there is Rx LO3 and the final
160 mixer, producing Rx IF3 at 10.7 MHz that goes to the digital board, to the rear
161 panel BNC output and to the WCDMA board (B68) if the latter is present.
162
163 How these RXTX boards fail
164 ==========================
165
166 There are 3 specific components on this RXTX board that have been seen to fail
167 over and over in the field:
168
169 * The second of the two cascaded IF2 SAW filters (Sawtek 855272) on the Tx side
170 often fails, breaking the Tx chain (output totally gone or extremely weak)
171 for all frequencies. Note that there are a total of 4 identical Sawtek 855272
172 filters on this board (2 on Rx side, 2 on Tx side), and only one of the four
173 fails: Tx side, second filter in the cascade.
174
175 * The "836 CD" filter on the Rx side is prone to failure. When it fails, the
176 visible symptom is severe attenuation in measured Rx signal levels for input
177 frequencies in the 1200 MHz < RF <= 2200 MHz range. Only the Rx side filter
178 fails, not the identical one on the Tx side!
179
180 * One of the two cascaded "CR" filters on the Rx side likewise fails - this time
181 it is the first one in the cascade. The other two identical "CR" filters on
182 the same board (the second in cascade for Rx and the one for Tx) are likewise
183 NOT seen to fail.
184
185 The root cause of all 3 component failures has been traced to galvanic corrosion
186 caused by direct contact between these components and Eccosorb RF absorber foam.
187 The complete RXTX board assembly consists of the traditional PCBA plus heavy
188 metal shields on both sides; the front and back metal shield pieces are custom-
189 made for this board, with individually shielded cavities matching different
190 sections of the board. Some (not all) of these cavities are filled with a
191 special black foam called Eccosorb - it is an RF absorber, presumably added to
192 prevent these cavities from acting as parasitic oscillators. Trouble occurs
193 when this Eccosorb foam comes into direct contact with metal surfaces of
194 components on the board: the result is galvanic corrosion, a process that takes
195 many years before it results in component failure. The reason why only 3
196 particular filter components fail is because they got the bad luck of residing
197 in cavities with Eccosorb - the other identical components that don't fail
198 reside in cavities without Eccosorb.
199
200 We don't know how R&S allowed this design flaw to escape and remain in their
201 sold and field-deployed products: there is the "innocent" explanation that they
202 simply didn't notice, and there is the conspiratorial view that this slow
203 failure mechanism is intentional as in planned obsolescense - pick your choice
204 of hypothesis.
205
206 How to repair failed boards
207 ===========================
208
209 All 3 of the failing filter components (one SAW filter part and two ceramic
210 monoblock filter parts) are now unobtainium. However, because so many of these
211 RXTX boards fail in exactly the same ways, our community at large is now
212 accumulating a very substantial "graveyard" of failed boards, and here is the
213 good news: we can make one good board out of every two failed ones. Suppose
214 that every RXTX board in our community's collective inventory has fully failed,
215 leaving no failure-free boards - what now? Here is the recipe for making one
216 good RXTX board out of two fully failed ones:
217
218 1) Out of the two failed boards, choose one to be the part donor and the other
219 to be the part recipient.
220
221 2) Take the part donor board and harvest 3 parts from it: one of the 3 Sawtek
222 855272 filters that aren't subject to corrosion, and the two IF1 filters
223 (one 836 CD and one CR) from the Tx side. Tx side IF1 filters aren't in
224 contact with Eccosorb and thus don't corrode, and 3 out of the 4 SAW filters
225 are likewise safe - hence we expect that every "dead" RXTX board can still
226 serve as a donor of good parts in this manner.
227
228 3) Take the part recipient board and transplant the donor parts onto it,
229 replacing all 3 corroded filters.
230
231 4) Before putting the repaired board back into its metal casing, cover all
232 corrosion-prone components with Kapton tape, preventing direct galvanic
233 contact with Eccosorb - this way the newly transplanted uncorroded components
234 won't suffer the same fate.
235
236 RXTX disassembly instructions
237 =============================
238
239 Before you can start working on an individual RXTX board, you first need to pull
240 it out of your CMU. Disassembly instructions are provided in the official part
241 swapper guide from R&S (which they call "service manual"), but here is the gist:
242
243 * Using a Torx T20 screwdriver, remove the 4 rear feet and lift the sleeve part
244 of the instrument case.
245
246 * Remove two small Phillips screws that secure the cover over the main board
247 cage, and lift that cover off.
248
249 * Unhook all MMCX little coax connections from the RXTX board: 3 on the top side
250 (IF3 interface) and one on the bottom (netclock input).
251
252 * Loosen and remove the two semi-rigid coax pieces that connect RF between the
253 RXTX board and the front end. In this Mother's opinion, this step is the
254 least pleasant of all, but it is unavoidable.
255
256 * After ensuring that nothing remains connected to the RXTX board on the bottom
257 side, pull the board out from the top.
258
259 Once you got the complete RXTX board assembly out, how do you extract the actual
260 board out of the metal casing? The not-immediately-obvious answer is that you
261 don't need to remove all of the screws, instead there are shortcuts that will
262 save you a lot of pain:
263
264 * There are two smooth thin metal plates, one on the front side of the board
265 (facing toward the front of the CMU when installed) and one on the back side.
266 Each is secured with a small Phillips screw. You only need to remove the one
267 on the front side. You don't need to remove the thin metal plate from the
268 back side of RXTX assembly - doing so will only add more clutter and loose
269 parts to your lab bench while the board is disassembled.
270
271 * Once you remove the thin metal plate from the *front* side of your RXTX
272 assembly, you will see all of the many screws that hold together the sandwich
273 of two heavy metal pieces with the board in the middle. These screws are
274 Torx T8.
275
276 * Put the board down on your bench so that the side that faces the front of the
277 CMU when installed (the side with the T8 screw heads) will become the top,
278 with the rear side becoming bottom.
279
280 * Each of the T8 screws passes through thread in the top metal piece, a hole in
281 the PCB, and then thread in the bottom metal piece. As you loosen these
282 screws, you don't need to remove them all the way - instead loosen each screw
283 so that its far end comes out of the thread in the bottom metal piece, but
284 let it remain captive in the top metal piece. Letting the screws remain
285 captive in the top metal piece will reduce bench clutter while the board is
286 disassembled, and there is a lot less screwing and unscrewing work to be done,
287 as there is no need to work through the thread in the top metal piece.
288
289 Once you loosen all of the T8 screws, the top metal piece should lift off,
290 leaving just the bottom metal piece and the PCBA. The bottom metal piece has
291 two thin metal pins sticking out of it; both the PCBA and the top metal piece
292 align on these two pins.
293
294 When you lift the top metal piece (the one with the screws), the side of the
295 board that will be immediately exposed to you is the side that faces the front
296 of the CMU when the board is installed. It is the Rx side, and you can confirm
297 that you are looking at the Rx side by noting that there are two "CR" filters
298 for high IF1, as opposed to just one. And chances are, right here at this step
299 in the disassembly process you will see the galvanic corrosion or the lead-up
300 to it.
301
302 As you lift the top metal piece from the board, look at its inside and note the
303 many individual cavities. Also note how some of these cavities are filled with
304 some black foam - that's the Eccosorb. And note how only some of the cavities
305 have Eccosorb in them, not all.
306
307 Now look at the ceramic IF1 filters on the Rx side of the board. The one "CR"
308 filter that is NOT in contact with Eccosorb will be bright copper-colored (it
309 actually is copper), whereas the two filters that are in contact with Eccosorb
310 (one 836 CD, one CR) will often be green instead of copper-colored on their top
311 surface - that's patinated copper! Furthermore, there will typically be some
312 black Eccosorb material directly adhered to the corroding top surfaces of those
313 two unlucky filters.
314
315 Now lift the PCBA off the two metal pins, separating it from the bottom metal
316 piece. Like you did with the top metal piece, observe the inside of the bottom
317 metal piece: note which cavities have Eccosorb in them and which don't. Then
318 flip the board over and look at its Tx side. You will see that there are only
319 two ceramic IF1 filters on this side (one 836 CD and one CR), and both should
320 be in pristine shape, bright copper-colored, no corrosion - these two are not
321 in contact with Eccosorb!
322
323 Now look at the two Sawtek 855272 filters on the Tx side. The one closer to
324 the middle of the board will often appear in worse physical condition that the
325 other 3 - and the culprit is once again in contact with Eccosorb.
326
327 MACOM SM4T mixer corrosion
328 ==========================
329
330 Neither I nor my collaborator on this project have seen an RXTX board on which
331 either the Rx SM4T mixer or the Tx one went bad - i.e., we haven't seen a
332 failure in this part *yet*. However, this mixer *is* in contact with Eccosorb,
333 and looking visually at the collection of RXTX boards in my possession, I
334 (Mother Mychaela) see definite signs of corrosion - the metal surface of this
335 SM4T mixer component is beginning to corrode. Therefore, as a preventative
336 measure, I recommend cleaning off any Eccosorb that is adhered to this component
337 and then covering the component with Kapton tape before putting the board back
338 into its metal casing.
339
340 Unlike the failing filters, this MACOM SM4T mixer is still available new - but
341 it's an expensive component, so let's protect these mixers from corrosion.