Avionics reverse-engineering: optical communications card

[D Straney]

Here's an interesting mystery board I got a while back:



The "18876ASSY..." part number indicates that it's from "US Army Aviation and Missile Command", from the 18876 CAGE code - so it's probably part of some aircraft equipment.

ASIC
One of the obvious parts is a big ceramic chip in the corner, which has a nice copper or brass piece connecting it to the frame, for conduction cooling.



Clock recovery module
Another obvious piece of weirdness is this AT&T TRU-200A module, with "180 Mhz" written on it:


Popping the lid reveals a SAW filter:

Evilmonkeyz has taken apart a similar part, the TRU-600A, which does clock recovery using the SAW filter:

This is used in telecom applications to separate a single bitstream (as transmitted over a communications link, for example) into distinct clock and data outputs.  Mine looks different inside than his, but I found photos of a TRU-200D that has a gold lid on the bottom side - so if I de-soldered mine, there would probably be a cavity underneath with the active electronics.

Digital logic
Over in the opposite corner is a bunch of digital logic, including a Zilog chip.

The ZX16C30 turns out to be a dual serial interface for a microprocessor.  It's pretty sophisticated: each serial channel can work up to 10 Mbps, and can handle a variety of bit encoding methods with 1s and 0s represented by input transitions with various timing combinations.  There's FIFO buffers too for the data, so the host processor's software doesn't have to handle each byte individually.

The rest of the digital logic nearby includes a lot of 74x244 & 74x245 buffers, likely for off-board interfacing to the external processor bus.

Optical transceivers
There's two gold modules with fiber optic stubs sticking out.  The one next to the ASIC is an optical transmitter (laser, Peltier cooler, & thermistor):

You can see how this is also heatsinked to the stiffening/cooling plate using the solid metal block at the right-hand side.

The module at the other corner is an optical receiver:

There's a photodiode mounted sideways on the ceramic block at the left-hand side, and the rest of the circuitry is a low-noise high-speed transimpedance amplifier.

Let's look at the rest of the analog section surrounding the receiver:


The tall metal can is a relay, but the other metal cans are all SL532C "limiting amplifiers", which give >400 Mhz of gain at 12 dB each.  All 3 of these are cascaded in series for 36 dB of gain total, from the optical receiver's output.  After the amplification comes a comparator in a ceramic DIP package - let's look back at the earlier photo to see that:

The AD96685 is a comparator with a propagation delay of only 2.5 ns.  It seems to take the analog optical-receiver output from the amplifier, turn it into a digital bitstream, and feed it to the TRU-200A clock & data recovery module next door.

Looking at the bottom side of the board, you can see the ground plane removed right at the receiver, and in smaller areas around the amplifier inputs & outputs, to reduce stray capacitance (this is something I had to do when building things with multi-hundred-Mhz GBP op-amps; a tiny bit of capacitance at the inverting input can easily stick a nice pole right in your loop transfer function that makes it unstable).


Hybrid module
There's a hybrid module near the optical transmitter: we're going to look at that later, but for now know that it holds the power functions for the transmitter, to drive both the laser and the Peltier cooler.



Function
Now that we've seen all the functional blocks, we've got some idea of how it all works together:


This seems to be an optical communications card for some kind of computer.  There's an empty spot at one edge for a 2x2 fiber coupler, which would likely connect to both the receiver & transmitter modules to use a single external fiber for both receiving and transmitting.

The CPU interface through the Zilog chip doesn't actually seem matched to the full capacity of the optical link.  The entire receive signal chain is built for speed: the TRU-200A supports up to ~180 Mbps, the SL532C amplifiers have >400 Mhz bandwidths, and the 2.5 ns propagation delay of the comparator supports up to 200 Mhz (if it takes an entire half-cycle for the output to transition).  However, the Zilog serial interface only can manage 20 Mbps at most with both its channels running at full speed.  The optical throughput is not going to be a full 200 Mbps once you include bit-stuffing or something like 8b/10b encoding to keep the clock recovery synchronized, plus framing overhead, error correction, etc.  But it's still a large gap of 5:1 there - so I'm guessing there's some TDM happening: may be multiple transceivers on the same fiber, not just a simple point-to-point link, and each gets its turn to transmit.  So, each transceiver may not need more than 20 Mbps of actual throughput, but when you put a few of them together sharing the same fiber, you need a whole lot more bandwidth to avoid stepping on each other's toes on the "party line".

[D Straney]

Next, it's time to look inside the transmitter-control hybrid module:



There's an H-bridge of power transistors, with a short-and-wide 1Ω current sense resistor on the low side (the green square with 3 laser-trimming marks in it):



Tracing the connections shows that these drive the Peltier cooler in the optical transmitter module.  We'll get to that in a minute.

All the way at the left is what seems to be a laser driver IC.  It connects to the ASIC & the transmitter module, and contains either a logo or an easter egg showing, well, a laser:


I think the structures in the left-center, with the two thick metal traces leading to the left-center bond pads (2 each, in parallel) might be the output power transistors that drive the laser diode.

The mess of resistors and discrete transistors below the H-bridge is centered on a die marked "124", and which is definitely a quad op-amp of some kind, likely an LM324.  It looks like I didn't do a full die shot, but here's an LM148 from a different hybrid module with a similar layout, to give you the general idea:


This whole analog section here is what controls the H-bridge.  Tracing the connections shows that it takes its input from the 10KΩ thermistor in the transmitter module, and so it's what decides when to turn on and off the Peltier module to keep the laser temperature regulated.  Interestingly enough, it does actually heat the laser sometimes too: otherwise, it would only need a single power transistor to switch the Peltier on and off in cooling mode, rather than a full H-bridge to reverse the polarity too.

Looking at the schematic I traced with a combo of up-close photos and some continuity testing with sewing needles, you can see that two of the LM124's op-amps are used as amplifiers (left), and two are used as comparators (right):

Q1-4 at the top are the power transistors forming the H-bridge, which drives the laser's Peltier cooler.  I put BJTs in the schematic but these very well may be power MOSFETs instead; I didn't test their properties due to all the other stuff connected to them.

R2 & the laser's thermistor form a voltage divider to produce a temperature-sensitive voltage.  R1 & R3 produce some sort of reference voltage, which goes to an external pin either for setpoint adjustment with an external series resistor, or for differential sensing (in case of significant series resistance in the connections to the thermistor).  U1C buffers the reference voltage, while U1D amplifies the difference between the actual temperature-voltage and the reference voltage.

These two voltages are compared by U1A & U1B.  Notice how the input connections are flipped: a larger U1D output turns on U1A, while a larger U1C output turns on U1B instead.  Each of these outputs turns on the H-bridge in one direction: so it cools the laser when U1D's output is smaller and heats the laser when U1D's output is larger, or vice versa.  It seems to be an on-off control vs. some kind of proportional PWM or linear drive.

The current sense voltage is fed back to the comparators, to increase the inverting input voltage on both.  I think the effect of this is to turn off the H-bridge completely if the current is too high.  However, it also has the effect of increasing the threshold as soon as the H-bridge turns on, which seems like it would immediately turn off the comparator output again, and cause oscillation until the temperature difference is large enough to make up for the current sense voltage too.  There's also no hysteresis, and no filtering, which again I'd expect to cause weird behavior around the temperature transitions.  Not at all how I'd design it, especially for a high-reliability application, but I assume there was some reason for doing it this way?

[D Straney]

Finally, here's a look inside one of the two DC-DC modules that supplies 5V to the board:



The input side is at the left.  This includes the control circuitry, a giant ceramic capacitor mounted to the wall, and two power MOSFETs (the gray rectangles):


The power MOSFETs drive a transformer, which feeds diodes (barely visible at the top of this next photo) and a buck inductor on the output side.  The transformer and buck inductor are the black cylinders: both are wound on pot cores.

You can also see a TVS diode mounted upside-down, and with wire bonds connected to it - unconventional construction in a pinch I bet.

The IC on the output side is a TL431:

For those unfamiliar, this is an "active zener diode" IC that's extremely popular for secondary-side voltage regulation in power converters.  Here, it seems to be connected to some thin wires that run back to the additional mystery pot core on the input side:

This suggests to me that, like one of the other aerospace DC-DC modules I looked inside, this uses magnetic isolation between the input and output.  This mystery pot core would be a small-signal transformer used for carrying the output-voltage feedback signal back to the primary-side controls.  Normal consumer applications would use optoisolators for this, but those are less popular in the aerospace world for their degradation over time (the transparent insulator gets opaque, I think) and extra radiation sensitivity.

Strangely, instead of a standard SMPS controller IC like the UC1843 series, the only other IC in the control section is a custom digital gate array:

This must be the DC-DC switching control, but not using the normal mostly-analog "sawtooth-oscillator + comparator + R-S flip-flop" approach.  There's not a lot of transistors there, but I haven't yet had the time to trace out the connections here and figure out the details of what it's doing.

[joseangel]

Oh my gosh! It's gorgeous... and smell really expensive!
Thanks for your time and sharing. The photos are great.