BenQ M32 revisited

[Mychaela Falconia]

Hello FreeCalypso community,

I've got a couple of updates regarding BenQ M32 modems, an existing
historical SMT modem module that competes with the mainstream SIM900
etc, but has a Calypso chipset inside.

The first update is that the supply of these historical BenQ modems is
now fully exhausted: I just bought the last remaining stock from Sure
Electronics, who were the only seller of this highly obscure and
uncommon historical product.  I now have 25 of these modules in my
hands and 21 more are currently on their way to me from China; after
sacrificing a few pieces to absolutely necessary destructive reverse
engineering, I will have about 40 of them left.  Anyone who needs one
or a few of these historical modem modules for some noble and worthy
purpose, please write to me off-list.

I need to emphasize at this point the stark difference in availability
between complete modem modules vs. just chips.  While the availability
of complete modem modules based on the Calypso chipset is almost non-
existent, the availability of Calypso and related *chips* is much,
much better: I can easily buy at least 10 to 20 thousand pieces of
each needed component from my trusted Chinese supplier with whom I
have an established working relationship, and that is how many I can
buy immediately with zero effort - if we ever need more than that, we
can definitely find more with some searching effort.

The other update is that I have identified the non-TI RF transceiver
that is used in these historical modem modules, the one which I
previously regarded as "unknown".  Take a look at these pictures:

https://www.freecalypso.org/members/falcon/pictures/BenQ/

module_top.jpeg and module_bottom.jpeg are pictures of the module as
shipped prior to any disassembly (they are pictures from the seller),
and cover_removed.jpeg is the top view with the shieldcan cover lifted
off.  I captured the latter pic with a 600 dpi scanner (the scanner
function of the typical office copier/printer/scanner machine) at my
day job - not the greatest, but that is all I have access to at the
moment.

Look in the upper right corner of the cover_removed.jpeg picture.  The
shiny component is the 13 MHz quartz crystal for the master clock (it
is just the crystal; the active part of the XO is in the Si4134T chip),
and the 3 little chips around it make up the Aero+ GSM RF transceiver
from Silabs, which is a 3-chip solution.  Amazingly enough, the
documentation for these Silabs transceivers (Aero, Aero+ and Aero II)
was readily findable, and I have added it to our FTP collection:

ftp://ftp.freecalypso.org/pub/GSM/Silabs/

Now that the RF transceiver used in BenQ's old modems is no longer an
unknown but is known to be Silabs Aero+, and now that we have a decent
datasheet for this Aero+ transceiver, porting our FreeCalypso fw to
run on the historical hw from BenQ is no longer impossible.  However,
it would still be a very non-trivial amount of work to write an
entirely new RF driver based on the datasheet alone and to integrate
it into our TI-based firmware architecture (getting all of the timings
just right will probably be the most difficult part), and given that
the total remaining availability of these historical BenQ modules is
only 40 pieces, the effort would be difficult to justify, so don't
hold your breath for me to do it.

However, if we go with my original idea of designing and building our
own FreeCalypso modem module in the form factor copied from BenQ M32,
then we not only gain the ability to produce them in any desired
quantity without limits, but we also won't be dependent on the
uncertain effort of getting a working RF driver for the Silabs Aero
family: in our own FreeCalypso semi-clone of BenQ M32, we can use our
familiar and well-supported TI Rita transceiver instead of Aero.  (Why
did BenQ use that Aero+ transceiver in the first place?  Based on the
age of BenQ's design, I am guessing that at the time of this design,
Rita was either not available yet or in the earliest stages of
availability, whereas TI's previous Clara RF is a monster in terms of
size, hence Silabs Aero+ was the best available option at the time.)

What would my proposed FreeCalypso semi-clone of BenQ M32 look like?
Again, let's refer to that cover_removed.jpeg picture.  I would keep
the internal partitioning wall that separates the baseband and RF
sections (our current Openmoko-based modem layout on the FCDEV3B has
it too, like every other commercial GSM phone I have seen), and the
baseband section (toward the bottom below the partitioning wall in my
picture) would remain essentially the same.  The Calypso and Iota
chips will need to stay in the same places where BenQ put them in
their floorplan, although we are going to use Calypso version D751992A
(same as on our current FCDEV3B) instead of BenQ's older D751774A -
but it's the same footprint.  For the memory BenQ used separate flash
and SRAM chips (4 MiB and 512 KiB, respectively); I would like to
replace them with a Samsung K5A3240 MCP (same flash and SRAM capacity,
but in one chip), but if it has trouble fitting, keeping the entire
baseband section unchanged from BenQ including their memory chips
would be just as fine.

The bigger changes would be in the RF section.  If you look in the
upper left corner of my picture, you will see the antenna switch and 3
discrete SAW filters, one for each of the 3 supported GSM Rx bands,
just like on our current Openmoko-based FCDEV3B.  My idea is to replace
them with an integrated antenna switch + SAW filters RF FEM which
would make the modem quadband, i.e., support all 4 GSM frequency bands
instead of just 3.  (Would it be possible to make a Rita-based or
Aero-based modem quadband using separate antenna switch and SAW filter
components, without going to a fully integrated FEM?  The answer is
yes, it would be possible, but it would be unwieldy in terms of size,
hence in practical terms quadband equals fully integrated FEM, with
both TI and Silabs transceivers.)

In the middle of the left side in my picture, the big black chip is
the RF PA, i.e., the main part of the radio transmitter.  The markings
are hard to read in my picture, but it is RF3140 by RFMD.  All RF31xx
PAs by RFMD are functionally equivalent in terms of specifications,
but differ in physical size - over the years of evolution, RFMD made
them smaller and smaller.  This RF3140 is a monster at 10x10 mm, and I
am guessing that RFMD probably made it as a footprint-compatible
replacement (for legacy designs like BenQ's) for their older RF3110.
In contrast, Openmoko used the newer RF3166 PA in a 6x6 mm package,
which is what we use on our current FCDEV3B.  In my proposed semi-
clone of BenQ M32, I would definitely use RF3166 instead of the older
and bigger ones, and use the freed-up space to help us fit the other
changes I have in mind.

Finally, we are back to the RF transceiver, the block in the upper
right corner in my picture.  My preferred approach would be to replace
it with Rita (like on our current FCDEV3B), also copying the 26 MHz
VCXO crystal and other associated components from Openmoko.  However,
if we have trouble fitting a Rita RF block into the same space, the
alternative would be to keep the Aero+ transceiver (or perhaps replace
it with the newer and more compact Aero II) and bite the bullet of
writing a new driver for it and getting it to work.  We'll cross that
bridge when we get to that part of the new PCB layout job, which is
pretty far down the line.

And now we go back to reality - what do we need in order to make it
happen?  Answer: the very first step we need to do before we can do
anything else along the plans elaborated above is to send a sacrificial
BenQ M32 module to a professional PCB reverser who can recover its HDI
layer structure (tell us how many layers it has, probably 6 or 8, and
what the blind/buried via and microvia structure is) and image each of
the copper layers, both outer and inner.  I have already reached out
to David Carne from REcon (he gave a presentation about HDI PCB RE at
the same conference at which I gave a presentation about FreeCalypso),
but I haven't heard anything back from him yet.  If David can't do it
for us, the alternative would be to send the sacrificial piece to
ScanCAD, the professional PCB RE company who do it on a commercial
basis - but the cost would be about $5500 USD.  Thus nothing will
happen until and unless someone donates that much money.

In the meantime, the plan to have our first batch of FCDEV3B V2 boards
around mid-January is still on track: when the folks at Technotronix
(our assembly shop) come back from their winter break after New Year,
hopefully they will get to doing our boards in the first or second
week of January as they promised to me earlier.

Hasta la Victoria, Siempre,
Mychaela aka The Mother