Modem schematic / RF help needed

[Dave Ball]

I've had a first stab at schematics for the Telit modem.  Comments,
feedback, abuse all welcome :-)

Noted missing is the antenna circuit.  Is the external antenna
connection something we want for gta02-core?  I know I'll not use it,
but I guess others might?  Also, I was hoping someone else might want to
have a look at the RF bits - I've no idea what's appropriate here, and
me guessing probably isn't the best approach!  Any takers?


All the best,

Dave

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Rask Ingemann Lambertsen-2]

On Sun, Sep 06, 2009 at 03:47:31AM +0100, Dave Ball wrote:
> I've had a first stab at schematics for the Telit modem.  Comments,
> feedback, abuse all welcome :-)

  Not much, but I came across this page from the wiki:
https://wiki.openmoko.org/wiki/One_transistor_too_many
Basicly, expect glitches on the SC32442B GPIOs when going into
suspend mode.

> Noted missing is the antenna circuit.  Is the external antenna
> connection something we want for gta02-core?  I know I'll not use it,
> but I guess others might?

   Well, if we expect 19 other users tops, I think you don't need to worry
about the possibility that someone wants an external GSM antenna. And
basicly, we'll dump the Telit GE865-QUAD for something more modern as soon
as we get the chance.

--
Rask Ingemann Lambertsen
Danish law requires addresses in e-mail to be logged and stored for a year

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Werner Almesberger]

Rask Ingemann Lambertsen wrote:
> Basicly, expect glitches on the SC32442B GPIOs when going into
> suspend mode.

Hmm, I've never heard of GPIO problems when going into CPU suspend.
There have been a severe issue in GTA01 with current still going
into the CPU when powering down (PMU Standby) and causing the CPU
to emit transients.

The problems was that such transients could cause the modem's reset
line to be asserted, via that transistor. This in turn brought the
modem out of "power off", and it happily started to burn power,
even though the system was supposedly off.

We've never seen that problem with GTA02. That may be because GTA02
has that modem "power switch" (U1705). I think it can't hurt to
route the modem's reset signal to a PMU GPIO, to make sure it's
stable even if we cut power to the CPU.

- Werner

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Dave Ball]

Werner Almesberger wrote:
> That may be because GTA02 has that modem "power switch" (U1705). I
> think it can't hurt to route the modem's reset signal to a PMU GPIO,
> to make sure it's stable even if we cut power to the CPU.

Modem ON/OFF or RESET?  Telit expects ON/OFF to be asserted low for 1
second to activate, so that might be less of a concern than reset (which
only needs to be help low for 200ms)

Should the modem be powered from VBAT or VB_GSM?  I've just noticed that
I had assumed the latter, but looking at U1750, VB_GSM is on the battery
side of the switch, where VBAT is actually the switched supply.

We've also dropped the over current detection (nGSM_OC) in -core, was
that intentional?  If so, is there any reason to keep R1751, R1753, C1753?


All the best,

Dave

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Werner Almesberger]

Dave Ball wrote:
> Modem ON/OFF or RESET?  Telit expects ON/OFF to be asserted low for
> 1 second to activate, so that might be less of a concern than reset
> (which only needs to be help low for 200ms)

I would just connect both and never worry about them again. We have
a spare GPIO that's been patiently waiting all these years for just
that :-) The GPIOs are open-drain, so we can even save the
transistors.  

> Should the modem be powered from VBAT or VB_GSM?  I've just noticed
> that I had assumed the latter, but looking at U1750, VB_GSM is on
> the battery side of the switch, where VBAT is actually the switched
> supply.

At least the RF amplifier has to be supplied directly from the
battery, because of its high current peaks. The question is now
if it even makes sense to provide a means to cut power to the
logic side of the module.

There are two reasons for having such a switch:

- make absolutely sure the modem can't turn on by accident, and

- prevent malicious firmware from spying on you (E.g., sending
  out your location even if the phone is supposedly turned off.)

I'm inclined to believe that Telit took good care of the first
issue. I'm not sure what the exact threat model is for a possible
implementation of the second.

> We've also dropped the over current detection (nGSM_OC) in -core,
> was that intentional?  If so, is there any reason to keep R1751,
> R1753, C1753?

If we keep the switch, then I'd also keep nGSM_OC in gta02-core. It's
a cheap way of diagnosing unexpected overcurrent situations.

- Werner

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Rene Harder]

Dave Ball wrote:
> I've had a first stab at schematics for the Telit modem.  Comments,
> feedback, abuse all welcome :-)
>  

Do we need the transistors Q8101/Q8102?
Telit mentioned that an open collector output is required but I'm not
sure if the GPIOs of the CPU are Hi-Z outputs or can be switched into
this state. However the PMU's GPIO lines are all open drain outputs so
there we wouldn't need them.
I think the current should not be a big problem for the GPIOs because
Telit specifies the max current on MODEM_ON is limited to 100uA.

> Noted missing is the antenna circuit.  Is the external antenna
> connection something we want for gta02-core?  I know I'll not use it,
> but I guess others might?  Also, I was hoping someone else might want to
> have a look at the RF bits - I've no idea what's appropriate here, and
> me guessing probably isn't the best approach!  Any takers?
>  

If we only use one internal antenna, the antenna circuit doesn't require
any additional components (assumed antenna Zin=50Ohm). The only
requirement is that the antenna is connected through a plain 50 Ohm
transmission line with less than 0.3dB loss.
What type of antenna are we going to use, is it a commercially available
one?


Rene

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Werner Almesberger]

Rene Harder wrote:
> What type of antenna are we going to use, is it a commercially available
> one?

Just the good old GTA02 antenna. Proper antenna design and
manufacturing is well beyond our grasp anyway.

- Werner

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Rene Harder]

Werner Almesberger wrote:
> Rene Harder wrote:
>  
>> What type of antenna are we going to use, is it a commercially available
>> one?
>>    
>
> Just the good old GTA02 antenna. Proper antenna design and
> manufacturing is well beyond our grasp anyway.
>  

Of course , but I'm wondering if this one is a custom design or a
commercially available one, what are the specs on this antenna?
I couldn't find anything on the inet regarding the GTA02 GSM antenna.

Rene

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Dave Ball]

Werner Almesberger wrote:

>> Should the modem be powered from VBAT or VB_GSM?  I've just noticed
>> that I had assumed the latter, but looking at U1750, VB_GSM is on
>> the battery side of the switch, where VBAT is actually the switched
>> supply.
>>    
>
> At least the RF amplifier has to be supplied directly from the
> battery, because of its high current peaks. The question is now
> if it even makes sense to provide a means to cut power to the
> logic side of the module.
>
> There are two reasons for having such a switch:
>
> - make absolutely sure the modem can't turn on by accident, and
>
> - prevent malicious firmware from spying on you (E.g., sending
>   out your location even if the phone is supposedly turned off.)
>
> I'm inclined to believe that Telit took good care of the first
> issue. I'm not sure what the exact threat model is for a possible
> implementation of the second.
>  

In which case, I'm not sure we gain much from this switch - it all ends
up controlled by the CPU, and from kernel code it's no easier to turn
the modem on accidentally one way or the other...

So I'd be inclined to drop it :-)  Doing so also means we have GPIO2 as
well as GPIO3 free on the PMU - and then avoid the transistors too.


Dave

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Dave Ball]

Rene Harder wrote:
> If we only use one internal antenna, the antenna circuit doesn't require
> any additional components (assumed antenna Zin=50Ohm). The only
> requirement is that the antenna is connected through a plain 50 Ohm
> transmission line with less than 0.3dB loss.
>  

Sounds good.  By the responses we've had so far, I'm happy to go with
the internal antenna only, which should be simple enough even for me! :-)


Cheers,
Dave

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Dave Ball]

Dave Ball wrote:
> Sounds good.  By the responses we've had so far, I'm happy to go with
> the internal antenna only, which should be simple enough even for me! :-)


I've now updated the modem with the changes discussed:

 - drop gsm power switch (U1705)
 - route MODEM_ON and MODEM_RST to PMU, removing the transistors
 - add the internal antenna, but not the external one.  


I think that leaves the modem complete - comments / flames / reviews
welcome as always! :-)


Dave

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Rask Ingemann Lambertsen-2]

On Mon, Sep 07, 2009 at 04:25:49PM -0300, Werner Almesberger wrote:
> Dave Ball wrote:
>
> > Should the modem be powered from VBAT or VB_GSM?  I've just noticed
> > that I had assumed the latter, but looking at U1750, VB_GSM is on
> > the battery side of the switch, where VBAT is actually the switched
> > supply.
>
> At least the RF amplifier has to be supplied directly from the
> battery, because of its high current peaks.

   Is it just that we need to find a power switch with lower on resistance?

> The question is now
> if it even makes sense to provide a means to cut power to the
> logic side of the module.

   Not likely. Someone malicious would have included the necessary voltage
regulator to feed the logic side from the RF side supply.

> There are two reasons for having such a switch:
>
> - make absolutely sure the modem can't turn on by accident, and
>
> - prevent malicious firmware from spying on you (E.g., sending
>   out your location even if the phone is supposedly turned off.)

   And three: Making sure the modem actually turns off when you turn off the
phone. In the GTA01, it would stay on unless you sent the AT@POFF command.

--
Rask Ingemann Lambertsen
Danish law requires addresses in e-mail to be logged and stored for a year

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Rask Ingemann Lambertsen-2]

On Mon, Sep 07, 2009 at 04:25:49PM -0300, Werner Almesberger wrote:
> Dave Ball wrote:
>
> > Should the modem be powered from VBAT or VB_GSM?  I've just noticed
> > that I had assumed the latter, but looking at U1750, VB_GSM is on
> > the battery side of the switch, where VBAT is actually the switched
> > supply.
>
> At least the RF amplifier has to be supplied directly from the
> battery, because of its high current peaks.

   Why? You can get power switches with a low enough on resistance.
Two 6-TSOP examples of 3.3 A, 55 [hidden email] V and 2.9 A, 60 [hidden email] V
respectively (and even with the same pinout):
http://search.digikey.com/scripts/DkSearch/dksus.dll?Detail&name=NTGD1100LT1GOSCT-ND
http://search.digikey.com/scripts/DkSearch/dksus.dll?Detail&name=SI3865BDV-T1-E3CT-ND

SuperSOT-6 package, 2.8 A, 55 [hidden email] V:
http://search.digikey.com/scripts/DkSearch/dksus.dll?Detail&name=FDC6331LCT-ND

   The Telit GE865 Hardware User Guide has examples of how to power the
modem from an LDO as well as from a step down converter. Why would it be
a problem to have a power switch between the battery and the RF amplifier
when you are supposed to get away with an LDO?

   The power switches listed above are quite a bit better than the 1.5 A,
110 [hidden email] V RT9702A one the GTA02 uses (RT9702A). About half the on
resistance and about twice the current rating. We also have a 100 uF
capacitor on the modem power vs. the 22 uF in the GTA02A6 and only 10 uF in
the GTA02A5.

--
Rask Ingemann Lambertsen
Danish law requires addresses in e-mail to be logged and stored for a year

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Werner Almesberger]

Rask Ingemann Lambertsen wrote:
>    Why?

Very good question :-) In theory, there should be no problem at all.
In practice, our hardware team found that the Calypso didn't work if
also the RF amplifier was connected through the switch. As far as I
know, the reason for this was never clearly determined.

So this may have been a quirk of the Calypso, poor characteristics
of the switch, or something else, which may or may not happen with
the Telit module as well.

>    The Telit GE865 Hardware User Guide has examples of how to power the
> modem from an LDO as well as from a step down converter. Why would it be
> a problem to have a power switch between the battery and the RF amplifier
> when you are supposed to get away with an LDO?

I was wondering about that too. Telit's documentation could be read
as saying that you need at least that 100 uF capacitor, plus whatever
it takes to handle the peaks, but that would be weird at best.

I'll feel much better about having the switch if it cuts all supplies
and not leave the modem in a probably completely undesigned-for
configuration.

We could try the following approach:

- bring back the switch (probably best to switch to the NTGD1100L
  while we're at it) and a pull-up

- route both VBATT and VBATT_PA through the switch

- add a 0R resistor parallel to the switch. Put it somewhere where
  it can be reworked. Since we feel confident, we make it NC for SMT.

- we then need to free one of the PMU's GPIOs. MODEM_nON might be
  the best choice, since the switch would override it anyway.

- put a 0R into MODEM_nON from the CPU so that, in case of trouble,
  we can fall back to the current configuration

Does that sound good ?

By the way, it seems that the ON/OFF insanity is systemic. All three
load switches you found use that stupid name we already complained
about with the Si1040X :-(

Thanks,
- Werner

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Werner Almesberger]

Dave Ball wrote:
> I've had a first stab at schematics for the Telit modem.  Comments,
> feedback, abuse all welcome :-)

I had a closer look at it now. I think we can save several test
points, since they also exist on the CPU side. In case of trouble,
we can fall back to soldering tiny wires to resitors.

Here they are:

        Net name Modem side CPU side
        --------- ---------- --------
        MODEM_TX P8107 TP1511
        MODEM_RTS P8108 TP1531
        MODEM_INT P8109 TP1526
        MODEM_RX P8110 TP1510
        MODEM_CTS P8112 TP1530

The ones to keep would be:

        MODEM_SERVICE P8101
        MODEM_MON P8106
        MODEM_SLEEP P8111

Then, I think we should name test points consistently, i.e., TP*
instead of P*.

Regarding the 33 Ohm series resistors, do they really have to be so
low ? They should be large enough to reliably protect the modem if
the CPU accidently switches one of those inputs to output, so I'd
be much more comfortable with something in the order of 1 kOhm.

While I don't know the rating of the clamping diodes of the GE865,
the limits I found for various microprocessors are in the range of
1-2 mA. With 1 kOhm, we would get (3.3-2.8)/1000 = 0.5 mA, which
is probably safe.

I think we should also add a remark that these series resistors
should be placed close to the CPU, to keep most of the traces close
to the low-impedance end (the modem's outputs).

Thanks,
- Werner

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Rask Ingemann Lambertsen-2]

On Fri, Sep 11, 2009 at 04:10:41AM -0300, Werner Almesberger wrote:

> I'll feel much better about having the switch if it cuts all supplies
> and not leave the modem in a probably completely undesigned-for
> configuration.

   Me too.

> We could try the following approach:
>
> - bring back the switch (probably best to switch to the NTGD1100L
>   while we're at it) and a pull-up
>
> - route both VBATT and VBATT_PA through the switch
>
> - add a 0R resistor parallel to the switch. Put it somewhere where
>   it can be reworked. Since we feel confident, we make it NC for SMT.
>
> - we then need to free one of the PMU's GPIOs. MODEM_nON might be
>   the best choice, since the switch would override it anyway.
>
> - put a 0R into MODEM_nON from the CPU so that, in case of trouble,
>   we can fall back to the current configuration
>
> Does that sound good ?

   I was thinking of just connecting the switch in parallel with R8101
(currently 0R that we would make NC) and connecting the enable input
(ON/OFF) to the GSM_2V8 supply. But I have not checked the power sequencing
requirements of the GE865. Right now I'm also confused by the lack of a
connection from the GSM_2V8 supply to the modem. Does it have an internal
2.8 V LDO to derive the I/O voltage from the 3.8 V supply?

--
Rask Ingemann Lambertsen
Danish law requires addresses in e-mail to be logged and stored for a year

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Werner Almesberger]

Rask Ingemann Lambertsen wrote:
>    I was thinking of just connecting the switch in parallel with R8101
> (currently 0R that we would make NC) and connecting the enable input
> (ON/OFF) to the GSM_2V8 supply.

Oh, that would be a very elegant solution. Since the level shifter
is operating only in the CPU -> modem direction, there should be
no risk of the modem accidently keeping GSM_2V8 up.

> requirements of the GE865. Right now I'm also confused by the lack of a
> connection from the GSM_2V8 supply to the modem. Does it have an internal
> 2.8 V LDO to derive the I/O voltage from the 3.8 V supply?

Yup. It's rather strange that they don't export a few mA of that
juice for level shifters.

- Werner

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Rask Ingemann Lambertsen-2]

On Sun, Sep 06, 2009 at 03:47:31AM +0100, Dave Ball wrote:
> I've had a first stab at schematics for the Telit modem.  Comments,
> feedback, abuse all welcome :-)

   The GE865 Hardware User Guide recommends that the antenna trace be
shielded on all sides by ground traces (page 26). Looking at "3.1.1 BGA
Balls Layout", I think we should tie GPIO_07 to ground, thereby completing
the shield of ground balls around the antenna ball. Admittedly, doing so is
in conflict with the statement on page 9: "If not used, almost all pins
should be left disconnected." (listing some exceptions, which doesn't
include GPIO_07.)

   GPIO_04/TX_DISAB can be used to disable the transmitter (11.4). A
possible use for it would be to detect surrounding cells for use with the
cellhunter/openbmap database without spending battery power or privacy on
transmitting your own position[1]. This signal needs no fancy level
translation, I think, just a simple voltage divider. We have GPB5 available
and no special function to use it for, I think.

   What are the chances I could persuade you to move the MODEM_SERVICE and
MODEM_SLEEP signals from GPJ2/GPJ3 (cpu.sch) to GPC8/GPC9 (lcm.sch) instead?
Just two signals less on the camera interface.
   
[1] After which you send a clear text HTTP request to a map tile server for
retrieval of the map tiles of the area you're in. :-( But we'll get there
eventually.

--
Rask Ingemann Lambertsen
Danish law requires addresses in e-mail to be logged and stored for a year

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Werner Almesberger]

Rask Ingemann Lambertsen wrote:
>    GPIO_04/TX_DISAB can be used to disable the transmitter (11.4).

Shouldn't CFUN=2 be good enough ? I think the hardware pin is more
intended for devices that have some sort of kill switch than as the
preferred means to turn off the transmitter.

- Werner

_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core

[Dave Ball]

Rask Ingemann Lambertsen wrote:

> On Sun, Sep 06, 2009 at 03:47:31AM +0100, Dave Ball wrote:
>  
>> I've had a first stab at schematics for the Telit modem.  Comments,
>> feedback, abuse all welcome :-)
>>    
>
>    The GE865 Hardware User Guide recommends that the antenna trace be
> shielded on all sides by ground traces (page 26). Looking at "3.1.1 BGA
> Balls Layout", I think we should tie GPIO_07 to ground, thereby completing
> the shield of ground balls around the antenna ball.

I had a look at this too, but didn't think it was worth doing.  Telit
have clearly designed the ball layout to have ground connections around
the antenna, and have plenty of NC pins they could have relocated gpio7
to if it was beneficial to also tie that pin to ground.  It seems that
they are happy for pin G6 to _not_ be ground, so I'm inclined to follow
their lead on this.

> What are the chances I could persuade you to move the MODEM_SERVICE and
> MODEM_SLEEP signals from GPJ2/GPJ3 (cpu.sch) to GPC8/GPC9 (lcm.sch) instead?
> Just two signals less on the camera interface.
>  

We had earmarked GPC8/9 for the existing HDQ & LCD_nRES nets, to free up
the secondary SPI for debug connector.  We do still have GPB4/5
available, and most of GPA.


Dave



_______________________________________________
gta02-core mailing list
[hidden email]
https://lists.openmoko.org/mailman/listinfo/gta02-core