--- a/CMU200-maintenance-notes	Thu Jan 13 19:07:19 2022 +0000
+++ b/CMU200-maintenance-notes	Fri Jan 21 05:26:17 2022 +0000
@@ -28,10 +28,11 @@
 This board is common among CMU200, CMU300 and CRTU-RU instruments from R&S - or
 at least these are the ones I know - maybe there are others I don't know about.
 This board encapsulates the instrument's main RF Rx and Tx chains: on the Rx
-side it takes RF input from the front end and performs triple IF downconversion
-to 10.7 MHz IF3, and on the Tx side it takes 13.85 MHz IF3 input and upconverts
-it to RF output, going through IF2 and IF1 in the process - triple IF in both
-directions.
+side it takes RF input from the front end and performs triple (or quadruple,
+explained later in this article) IF downconversion to 10.7 MHz IF3, and on the
+Tx side it takes 13.85 MHz IF3 input and upconverts it to RF output, going
+through IF2 and IF1 in the process - triple or quadruple IF in both directions,
+as explained in more detail later in this article.
 
 Every CMU200 instrument always has one RXTX board - it is an absolutely required
 component irrespective of option configurations.  The hardware architecture of
@@ -68,23 +69,68 @@
 frequency ranges.  The failure symptom is unexpected large attenuation:
 sometimes around 5 to 6 dB of loss, othertimes as much as 25 dB of loss.
 
+The internal loopback test invoked from the Maintenance menu is a good first
+step in diagnosis.  In this test the instrument software configures both Rx and
+Tx chains to connect to RF1 (and then RF2 if you press Continue), and then it
+tests a longish list of different frequencies in sequence, spanning the full
+range from 10 to 2700 MHz.  For each test frequency, the instrument software
+configures both the signal generator and the Rx chain, and it reports what was
+measured on Rx vs. what was put out on Tx.  The test is considered a failure if
+nothing was received or if the Rx signal level was too far from the expected
+value, otherwise the test is declared as passed.
+
+If the loopback test fails at every frequency with no signal detected, then you
+don't really know what's going on, and you will need to manually test Rx and Tx
+separately (using an external spectrum analyzer and an external signal
+generator) in order to figure out what is broken.  However, out of the commonly
+observed failure modes, dead Tx will produce this symptom.
+
+If the Tx side is OK but Rx IF1 filters (one or both paths) have gone bad, the
+visible symptom in the loopback test will be Rx signal level that is lower than
+it should be.  The instrument software may declare the test as either passed or
+failed depending on the magnitude of the error: in this Mother's experience,
+when one of the two IF1 paths on my CMU200 developed a loss of some 5.8 dB, the
+loopback test was reported as passing - but a closer look at the numbers in the
+report window showed the unexpected attenuation.
+
+Because different input frequency ranges are handled via different Rx paths as
+explained in the following section, when Rx IF1 filters fail, the loss behaviour
+will be frequency-dependent.  In the internal loopback test, you will see one
+behaviour for frequencies from 10 to 1200 MHz, then a marked change for
+frequencies from 1205 to 2200 MHz, and then another change (most likely a
+reversion to low frequency behaviour) at the highest frequencies above 2200 MHz.
+
+We do not currently know if there are any other failure modes elsewhere in the
+CMU200 instrument that can also cause a stepwise change in behaviour at these
+frequency cutover points.  It is my (Mother Mychaela's) suspicion that the front
+end may have some filters too, each covering a wide frequency swath, with
+instrument software switching these filters depending on the configured
+listening frequency - but we don't know for certain if any such additional
+filters are there or not.  If you find yourself wondering whether the problem
+you are seeing is in the RXTX board or the front end, the best way to narrow it
+down would be to remove the semi-rigid coax pieces that carry RF between the two
+and use an external spectrum analyser to look at the Tx output from the RXTX
+board and/or the Rx output from the front end.
+
 RXTX board architecture explained
 =================================
 
 Unfortunately R&S' official service manual for CMU200 instruments is only a part
 swapper guide: it tells you which boards do what in general terms and tells you
 how to remove and replace each part, but no schematics, and no detailed
-explanation of what happens inside each board.  However, I draw the reader to
-the block diagram on page 3.2 of this manual - this block diagram does provide
-an important starting point for understanding what happens inside the RXTX
-board.
+explanation of what happens inside each board.  They do provide a little bit of
+info: I draw the reader to the block diagram on page 3.2 of this manual - this
+block diagram does provide an important starting point for understanding what
+happens inside the RXTX board - however, it is simplified and incomplete.
 
 In the Tx direction, 13.85 MHz IF3 comes in from the digital board - or from
 B68 board in WCDMA test modes.  This Tx IF3 is mixed with Tx LO3 to produce
 Tx IF2.  This Tx IF2 is fixed at 487.52 MHz, thus one would think that Tx LO3
 frequency ought to be fixed as well - but it seems to be a synthesized variable
-frequency.  (Remember, all of this understanding is from reverse engineering,
-hence we can only figure out so much.)
+frequency, and the manual describes it as "LO3TX with small tuning range".
+Calculations done by Michael VK2BEA put Tx LO3 at 473.67 MHz (needs
+confirmation), but it is still not clear why it is a synthesized frequency
+"with small tuning range", as opposed to simply fixed.
 
 Tx IF2 of 487.52 MHz is then passed through a pair of identical SAW filters,
 Sawtek 855272 - two cascaded identical filters, with an amplifier in between.
@@ -95,6 +141,11 @@
 only guess.  As I shall explain later in this article, one of these two Tx IF2
 SAW filters is a component prone to failure.
 
+[Note from Michael VK2BEA: "The LO frequency is only 13.85 MHz from the IF.  It
+makes sense to shift this to the edge of the passband to help the suppression
+of LO feed through.  Also explains the use of SAW filters (sharp skirts) and
+that there are two."]
+
 After these cascaded SAW filters, Tx IF2 is mixed with LO2.  Unlike LO1 and LO3,
 there is only one LO2 for both Rx and Tx, and it is fixed at 1329.6 MHz.  When
 Tx IF2 at fixed 487.52 MHz is mixed with LO2 at fixed 1329.6 MHz, the output of
@@ -107,11 +158,33 @@
 as on the Rx side or not - maybe they are the same, maybe they are different.
 
 After Tx IF1 output is combined or switched from the two filters, it is mixed
-with Tx LO1 to produce the final RF output.  The mixer that does this job is
-MACOM SM4T, which is one of the larger, prominently visible components on the
-board.  There also seems to be a fourth mixer and LO stage that kicks in only
-for frequencies above 2200 MHz, but I haven't really studied that one as my main
-interest is in the classic cellular frequency bands, 1900 MHz and below.
+with Tx LO1 to produce an output that may or may not be final RF.  The mixer
+that does this job is MACOM SM4T, which is one of the larger, prominently
+visible components on the board.  Tx LO1 has "large tuning range and very fine
+frequency resolution used for setting the desired transmitter frequency" - quote
+from the manual; by doing some frequency arithmetics, we can see that this Tx
+LO1 tuning range needs to span from 1827.12 to 3042.08 MHz in order to produce
+output frequencies from 10 to 2200 MHz starting from 842.08 MHz or 1817.12 MHz
+IF1.  (LO1 - IF1 is the desired output frequency, whereas the sum will be a
+much higher frequency above 2.7 GHz - I presume that the latter must be
+suppressed by some LPF somewhere.)
+
+The "RF" output from Tx SM4T mixer (LO1-IF1 as explained above) is indeed the
+final RF output going to the front end for output frequencies below 2200 MHz.
+In the uppermost frequency range of 2200 to 2700 MHz, a fourth mixer and LO
+stage come into play - NOT shown on the block diagram in the manual!  In this
+highest frequency range, the output from SM4T mixer should be considered a
+fourth IF - but because it is not covered at all in the manual and not named,
+we have to invent our own name for it.  I (Mother Mychaela) propose that we
+call it IF0, and refer to the corresponding LO as LO0 - this way we remain
+consistent with official naming that puts IF1 closest to RF and IF3 closest to
+digital.
+
+The preliminary analysis by Michael VK2BEA is that Tx LO0 frequency is fixed at
+3318.46 MHz (same as its counterpart on the Rx side), with IF0 (taking the place
+of lower RF) ranging from 1118.46 to 618.46 MHz (reverse range) to produce final
+output frequencies of 2200 to 2700 MHz.  However, these numbers have NOT been
+confirmed by actual measurements yet.
 
 On the Rx side the same process happens in reverse, but the specific frequencies
 used for IF1, IF2 and IF3 are slightly different.  At first there is a stage
@@ -160,6 +233,54 @@
 mixer, producing Rx IF3 at 10.7 MHz that goes to the digital board, to the rear
 panel BNC output and to the WCDMA board (B68) if the latter is present.
 
+Frequency conversion tables
+===========================
+
+Michael VK2BEA worked out a pair of frequency conversion tables, one for Rx and
+one for Tx.  Here are these tables, with further corrections by Mother Mychaela:
+
+Rx frequency conversion, RF to IF1:
+
+RF (MHz)    LO0 (MHz)   IF0 (MHz)        LO1 (MHz)           IF1 (MHz)
+----------------------------------------------------------------------
+  10-1200                                1826.115-3016.115   1816.115
+1200-2200                                2043.085-3043.085    843.085
+2200-2700   3318.46     1118.46-618.46   2934.575-2434.575   1816.115
+
+Rx frequency conversion, IF1 to IF3:
+
+IF1 (MHz)   LO2 (MHz)   IF2 (MHz)   LO3 (MHz)   IF3 (MHz)
+--------------------------------------------------------
+1816.115    1329.6      486.515     497.215     10.7
+ 843.085    1329.6      486.515     497.215     10.7
+
+Tx frequency conversion, IF3 to IF1:
+
+IF3 (MHz)   LO3 (MHz)   IF2 (MHz)   LO2 (MHz)   IF1 (MHz)
+---------------------------------------------------------
+ 13.85      473.67      487.52      1329.6      1817.12
+ 13.85      473.67      487.52      1329.6       842.08
+
+Tx frequency conversion, IF1 to RF:
+
+IF1 (MHz)   LO1 (MHz)         IF0 (MHz)        LO0 (MHz)   RF(MHz)
+------------------------------------------------------------------
+1817.12     1827.12-3017.12                                10-1200
+ 842.08     2042.08-3042.08                              1200-2200
+1817.12     2935.58-2435.58   1118.46-618.46   3318.46   2200-2700
+
+Notes:
+
+* In Michael's original version each table covered the full chain from RF on
+  one end to IF3 on the other end, but I (Mychaela) had to split each table
+  into two in order to fit within 80 columns.
+
+* The numbers for LO3 (473.67 MHz for Tx, 497.215 MHz for Rx) are from Michael;
+  I (Mychaela) have not verified them.
+
+* All details for the IF0/LO0 stage (upper frequency range) are from Michael;
+  his notes indicate that the numbers are confirmed for Rx, but not for Tx.
+
 How these RXTX boards fail
 ==========================
 
@@ -189,7 +310,7 @@
 made for this board, with individually shielded cavities matching different
 sections of the board.  Some (not all) of these cavities are filled with a
 special black foam called Eccosorb - it is an RF absorber, presumably added to
-prevent these cavities from acting as parasitic oscillators.  Trouble occurs
+lower the Q of these cavities to prevent parasitic oscillations.  Trouble occurs
 when this Eccosorb foam comes into direct contact with metal surfaces of
 components on the board: the result is galvanic corrosion, a process that takes
 many years before it results in component failure.  The reason why only 3
@@ -197,11 +318,18 @@
 in cavities with Eccosorb - the other identical components that don't fail
 reside in cavities without Eccosorb.
 
-We don't know how R&S allowed this design flaw to escape and remain in their
-sold and field-deployed products: there is the "innocent" explanation that they
-simply didn't notice, and there is the conspiratorial view that this slow
-failure mechanism is intentional as in planned obsolescense - pick your choice
-of hypothesis.
+[Note from Michael VK2BEA: "The copper surface of these filters form an integral
+part of the component.  It is this copper that forms the cavity of the combline
+filter.  When this is compromised by corrosion, the filter is detuned and there
+is leakage causing excessive loss."]
+
+It appears that R&S only noticed this design flaw toward the end of "product
+life" of these instruments, probably because failures occur only after many
+years.  Some of the newer boards have had modifications to prevent contact
+between Eccosorb and the two troubled Rx filters, either by way of thinner
+Eccosorb fill or by way of an added plastic barrier.  It is not clear if these
+modifications were applied to newer produced RXTX boards from the start, or if
+they are a result of field service repairs.
 
 How to repair failed boards
 ===========================
@@ -339,3 +467,11 @@
 
 Unlike the failing filters, this MACOM SM4T mixer is still available new - but
 it's an expensive component, so let's protect these mixers from corrosion.
+
+[Michael VK2BEA notes: "The case of the mixer is purely for shielding and is
+much thicker than the thin copper of the filter that is essential for
+operation."  Mother Mychaela's response: it may be so, but if you are going to
+take the RXTX board out of your CMU, take it out of its metal casing and either
+replace filters or at least cover them with Kapton tape for protection, it
+won't hurt to put the same Kaptop tape on the mixers too - and the signs of
+corrosion are very real.]