Tango module technical details

[Mychaela Falconia]

Hello FreeCalypso community,

Almost a year ago in December of 2019 I discovered the existence of
these very obscure historical GSM/GPRS modem modules that have our
beloved Calypso chipset inside:

https://www.iwow.com.sg/downloads/tr-800-module/

For the past 10 months we (FreeCalypso core team and Falconia family)
have had to keep this knowledge private because of a certain
unfortunate political situation: certain people who discovered the
existence of these modules independently of us were using them for
certain highly unethical purposes that run totally counter to the
mission and values of FreeCalypso, there was a credible threat that
further additional parties would join in those misuse activities if we
were to publish our discovery, and so the only safe course of action
for us was to wait and work on possible mitigation strategies.

A lot of work has been done behind the scenes over these months to
prepare for a controlled disclosure: while it is inevitable that some
people will misuse this newly disclosed knowledge for nefarious
purposes that go totally against the mission and values of FC, and
unfortunately there is no way to stop this misuse without taking away
from legitimate FC users, we can at least shift the balance: with the
work we have done in terms of FC Tango rebranding and Caramel2 board
design, the hope is that the positive benefit from the present
disclosure will outweigh the negatives.  Thus the time for disclosure
has arrived.

Extensive technical documentation for iWOW TR-800 modules that are now
being rebranded as FreeCalypso Tango is gathered in these two FTP
directories:

ftp://ftp.freecalypso.org/pub/GSM/iWOW/
ftp://ftp.freecalypso.org/pub/GSM/FreeCalypso/Tango/

The recommended reading order is to read these two documents first,
before any others:

TR800_PrdctTechSpecsv2.6.pdf
FC-Tango-MIG-v1.2.pdf

A very important point about nomenclature: should the article be
referred to as iWOW TR-800, or as FreeCalypso Tango?  The answer
depends on whose firmware resides in the module flash: for as long as
iWOW's original fw remains intact, the module is an iWOW TR-800, but
when we (Falconia Partners LLC) resell these modules with our own
FreeCalypso firmware, then the product becomes FC Tango.

The way I see it is as follows: when iWOW created and marketed their
product which they named TR-800, they intended this name to refer to
*their* product as *they* sold it.  The functionality of the product
which they sold and marketed under their chosen name is defined much
more by firmware than by hardware: when iWOW marketed their TR-800,
they marketed it as a GSM/GPRS modem product with certain iWOW-added
functionality like MMS and TCP/IP and with specific iWOW-added custom
AT commands, and all of that functionality is the work of iWOW's fw
rather than hw.  iWOW's TR-800 fw is derived from TI's original just
like our FreeCalypso fw (in evolutionary biologists' terminology they
share a most recent common ancestor that lived some time in the early
2000s), but of course we don't have any corresponding source for
iWOW's modified fw or for any of their value-added developments that
aren't in TI's baseline.

Because we don't have any corresponding source for iWOW's fw and
because iWOW's fw changes relative to TI's baseline are quite
significant, a TR-800 module running iWOW's original firmware is
fundamentally nothing interesting - it is just another proprietary GSM
modem module with closed black box firmware no different from the
average 100% closed and proprietary crop that is sold for $2 apiece
these days.  Instead TR-800 hardware becomes interesting and valuable
if iWOW's proprietary sans-source fw with gawd knows what changes is
completely removed and replaced with our own FreeCalypso fw whose
corresponding source is freely published and which is developed in the
open.  But because our FreeCalypso fw does not implement functions
which iWOW considered important in their day (in-modem TCP/IP and MMS
primarily), when we replace module fw with our FreeCalypso, the
resulting module is no longer an iWOW TR-800 in my argument, and I
call the resulting product offering FC Tango.

Legally speaking, FreeCalypso is a registered trademark belonging to me:

https://www.freecalypso.org/members/falcon/legal/fc-tm-reg-cert.pdf

Right now I am waiting for our Caramel2 development boards to be
produced (PCBs expected to ship in another day or two, then we'll need
assembly), and I plan on using one of these boards as a programming
station for soft-transforming modules from iWOW TR-800 to FC Tango.
Modules sold as FC Tango will be identified with a sticker affixed to
the outer surface of the module, this sticker will bear our FreeCalypso
trademark that can be legally applied only by me, and these trademark
stickers will serve to differentiate our official FC Tango product
from cheap knock-offs.

I have a certain stock of iWOW TR-800 modules here at FreeCalypso HQ,
and I can resell these modules either as unchanged iWOW TR-800 or as
FC Tango.  I also have an established business relationship with a
Chinese supplier who has a larger stock.  I will not reveal any
business details of my supplier or my workings with them - you are
welcome to search online on your own and you will probably find a
supply pretty easily (there are several suppliers, the one I work with
is not the only one), but I will not provide any help or support
whatsoever to anyone who sources iWOW TR-800 modules from any party
other than Falconia Partners LLC.

I can sell TR-800 or Tango modules in the following 3 ways:

Option 1: I ship modules with FC firmware in their flash, with FC Tango
stickers affixed, and the product is legally named (on customs forms
etc) FC Tango rather than iWOW TR-800.  These modules will also be
tested as part of flash programming process, and thus will be known
working.  The price for this option is $40 per module, and there is
no MOQ: you can buy 1 piece or 1000 pieces or anything in between.

Option 2: for those who don't want our FC Tango firmware or branding,
but who still desire tested and known working modules, I can sell
tested but flash-unchanged TR-800 modules for the same price of $40
apiece with no MOQ.

Option 3: for those who are looking for the absolute lowest price, I
can sell untested modules for $25 apiece, again with no MOQ.  However,
any modules sold under this option will be sold strictly as-is
*without* any assurance of quality (they could be dead for all I know),
and the buyer will have to explicitly agree to as-is, no refund and
no return terms - it is simply not economical to provide any kind of
service guarantees at this insanely low price point.

Options 1 and 2 will become available once our Caramel2 boards get
built and I can use one of them as a programming and testing station -
expecting some time in December, or maybe even November if we get
lucky.  Option 3 is available literally right now if someone really
wants it, but I don't recommend it.

Now onward to development boards.  iWOW once made their own official
development board for TR-800 modules, described in the document named
TR-800-Development-Starter-Kit-UserGuide_v1.2P5.pdf in our FTP
collection, but the problem with these original DSK boards is
scarcity: to the best of my knowledge, there are only two of these
iWOW DSK boards in the world, I have one and Das Signal has the other.
These original iWOW DSK boards have been codenamed Caramel in our
FreeCalypso core team work, and our own Caramel2 development board
design is intended to be a replacement for these original DSK/Caramel
boards.

Because our FC Caramel2 boards haven't been physically produced yet
(PCB fab should be complete or nearly so, waiting for them to ship),
we don't have any real photos to share, but we do have these artistic
renderings that were produced by our hired PCB layout contractor
Majenko:

https://www.freecalypso.org/members/falcon/Caramel2/preview/

Majenko used some fancy 3D modeling tools that are way beyond my
understanding to produce these renderings, and they certainly look
impressive.  A few part models are slightly incorrect (for example,
the power input connector will be the same orange part as on FCDEV3B,
not green as in the artistic rendering), but the drawings do provide a
good general idea of what we are going to get when these boards are
physically built.

Right now there are no graphical schematics for FC Caramel2.  When the
boards are produced and become available for public sale, I may either
publish the non-graphical schematic-equivalent source code for the
board like I did with DUART28, or I may hire Matt again to draw a
traditional graphical schem - I haven't decided yet.  But FC Caramel2
is essentially a semi-clone of iWOW's DSK aka Caramel, and the
schematics for iWOW's DSK v5.0 (the version used as the reference for
Caramel2) appear on the last page of iWOW's
TR-800-Development-Starter-Kit-UserGuide_v1.2P5.pdf document.  So if
you look at iWOW's original schematics, you should get a close idea as
to what you will get with Caramel2.

There are only two major differences between iWOW's DSK and Caramel2:

* Power supply: iWOW's DSK takes 5V power input and produces a VBAT
supply of 3.8 V with an on-board LDO regulator.  Caramel2 will instead
take in ready-made VBAT from an external power supply, just like
FCDEV3B.  We have a box of 100 little PSU bricks that were custom-made
for us, taking universal AC input and putting out 3.6 VDC at 2.2 A,
fitted with the right connectors, and this PSU accessory costs only $7
- thus every board will be shipped with a PSU, users won't be burdened
with having to provide their own.

* Calypso UARTs: iWOW's DSK features on-board RS-232 level shifters
and brings out two old-fashioned DE9F serial ports.  Caramel2 will
bring out both Calypso UARTs in their native LVCMOS form instead, just
like FCDEV3B, and our officially recommended USB to dual UART adapter
is our recently produced DUART28.

I expect these Caramel2 boards to reach the point of sellability by
December, and I am hoping to fit within the following price targets:

* For a reduced kit consisting of a Caramel2 board and a power supply,
with the user needing to provide their own USB to LVCMOS UART adapter,
I am hoping to get the price down to around $150.

* For a complete turnkey kit consisting of a Caramel2 board, a power
supply, a DUART28 adapter and a ribbon cable connecting the two boards,
I am hoping to get the price down to around $220.

Right now the main remaining cost uncertainty is assembly labor.  I do
NOT outsource my board assembly to distant shops half-way around the
world with whom I could never interact physically, instead I use a
board assembly shop that is physically local to me in California, and
I always hand-deliver all of the parts to them after first gathering
and inspecting them at FreeCalypso HQ.  I have a several years long
very satisfied working relationship with them, small American family
businesses need all of our support right now, so I will NOT transfer
my board assembly business from this local California shop to some
Chinese or Mexican or other race-to-the-bottom operation.

But my choice of ethical business practice in terms of board assembly
does make our boards more expensive.  In the case of FCDEV3B the
assembly labor cost was about $100 per board (that is just assembly
labor, on top of PCB and part costs); in the case of DUART28 the bare
break-even total cost is $55 per board, and $30 out of that total
(more than half) is assembly labor.  In the case of Caramel2 the total
cost of all parts and the PCB is about $85, but the assembly labor
cost is not yet known.

The other big contingency is that all of my hopes are currently pinned
on the expectation that all of the iWOW TR-800 modules I bought are
still 100% good after all of these long years of storage, and that
every one of them will yield a perfectly working Caramel2 board when
populated.  In the case of FCDEV3B we had very unpredictable yield,
every time I would order a batch of boards to be assembled, it was a
spin of the roulette wheel if we would get all good boards, all bad,
or anywhere in between, and this yield unpredictability is the main
cost driver, the reason why I cannot fairly sell non-discount FCDEV3B
V2 boards for less than $500 apiece: I have a few boards in stock, but
I have no way of predicting how much it would cost to replenish the
stock if they get sold out, thus the true break-even production cost
is essentially unknown.  Right now the big hope is that this yield
fiasco won't be repeated with Caramel2, and this hope is the basis for
my predictions of much lower prices for C2 than for FCDEV3B - but we
won't know for another couple of months, until we go through the full
process of C2 board assembly and get to the moment of truth.

Aside from cost issues, Caramel2 will have a few interesting technical
advantages over FCDEV3B: Tango modules are fully quadband, and the rich
set of Calypso+Iota chipset signals they bring out allow a full handset
to be built around Tango: the Calypso memory bus is brought out
(allowing for peripherals like large LCDs), the keypad interface is
brought out, battery charging control signals are brought out, etc.
All of these signals are brought out on the 56-pin expansion interface
on the Caramel2 board (see Caramel2Top.jpg drawing and iWOW's DSK
schematics), allowing connection of interesting add-ons.

One add-on we already have is our FC Luna handset UI development
platform, which consists of an LCD carrier board and a keypad board
connected to the 56-pin expansion interface on the original DSK/Caramel
board.  Our C2 expansion interface is strictly unchanged from iWOW's
original, thus the exact same Luna LCD and keypad add-on boards will
work with Caramel2 once C2 itself becomes a reality.  Right now this
Luna UI development platform is available only to me and Das Signal
because there are only two original DSK/Caramel boards left in the
world, but with C2 we'll be able to make this Luna UI development
platform available to anyone interested.  Our Luna LCD is 176x220 pix
color TFT, parallel interface connected to Calypso memory bus, exactly
the same display resolution and data transfer interface as on TI's
original D-Sample.  Our Luna keypad board is a simple 5x5 matrix of
keyswitches, with silk screen labels matching D-Sample keypad layout.

There is, however, one feature that is absolutely not available on
TR-800/Tango modules and thus on any platform built around them, and
that is Calypso JTAG: it is simply not brought out on the TR-800, the
signals never leave BGA pads under the Calypso chip, just like on
Openmoko devices.  nIBOOT is solidly grounded on the module PCB, thus
Calypso boot ROM is always enabled, there is no possibility of
bricking and thus no need for JTAG unbricking, but for those looking
for JTAG as a development aid, Tango is not the right platform.  For
those who need Calypso JTAG, FCDEV3B will always remain available,
albeit expensive.

And yes, I have already incurred the expense of getting TR-800 fully
reverse-engineered: I spent close to $1600 on that PCB RE job, and our
company has reconstructed Protel/Altium PCB design and Gerber files
for iWOW's TR-800 module PCB.  It's a 6-layer PCB with HDI structure
(blind & buried vias), and we've got all copper layers and all vias
fully recovered.  In the unlikely event that someone places an order
for a larger quantity of Tango modules than the available stock of
iWOW-made TR-800 surplus, we can produce our own clone modules that
will be legally FC Tango from the beginning - but the more immediate
use for this PCB RE was reconstructing 100% of the internal circuit
structure, i.e., components and netlist.  My philosophy is that if we
are rebranding these iWOW-made modules into FC Tango, we need to be
able to support the result as a bona fide FreeCalypso product, the
same as if we had designed and produced it ourselves, and that level
of support implies the requirement to know what every resistor and
every capacitor inside the module are for, and where every pin of
every component is connected, without any question marks left.

The raw PCB RE files for which I paid $1600 are currently unpublished,
and my current plan is to keep them unpublished until and unless
someone makes a donation/reciprocation payment of $1200 to partially
offset what I paid - my idea of fairness principle.  But the netlist
which I have reconstructed from this PCB RE is published, and so is my
assigned component reference designator plan - I had to assign a
reference designator to every component, every unpopulated component
footprint and every contact pad or group of contact pads on the
reverse-engineered PCB.  If someone else is going to do further RE on
these modules, such as removing and measuring every R/L/C passive, I
urge them to use the same reference designators which I've assigned,
so we can work in synergy.

Hasta la Victoria, Siempre,
Mychaela aka The Mother