Reverse-engineering misc. avionics (ongoing)

[peter-h]

The amount of money spent on that board full of gold plated chips and the big "LSI" one is unbelievable. 1000s and 1000s of USD. It's a whole different world.

[D Straney]

Voice Warning Generator from F-4 fighter jet (continued)
(Continued from earlier)
I traced the high-level connections on the PCB and tried powering it up a while back, and poking the input pins one at a time with 5V, but got only white noise from the audio output.  So, I succumbed to temptation and sawed open both hybrid modules:


As expected, the smaller one is for interfacing.  It protects the external inputs with series resistors, clamping diodes, and filter capacitors, and feeds them to a Schmitt-trigger inverter (the CD40105).  One of the other dies onboard is a CD4011 quad NAND gate which does a little bit of logic with the inputs (a global enable/disable); the third die is an op-amp which takes the current-mode output from the DAC and converts it to the final audio output voltage to send through the external connector.  There's also a power-up reset circuit which generates a global reset for the larger hybrid module.

(I've got a full schematic for this one but it isn't worth posting until I finish tracing the connections in the large hybrid module)

The large hybrid module, also as expected, contains the circuitry for playing back the audio samples from memory, implemented entirely in RCA's CD4000-series digital logic.  There's a couple counters, a few shift registers, a bunch of gates, and a lot of 4013 D-type flip-flops.  I haven't finished tracing this one, so no schematic yet: it has at least 3 layers of connections that can be seen faintly through the thin aluminum-oxide(?) substrate, so a lot of continuity checks with sewing needles are needed to dis-ambiguate a lot of the connections, and have a shot at eventually making it play sound.


Some microscope work at my local hackerspace was essential here in getting a close enough view of the chips to read out the ID numbers written on the metal layers and identify them from that, starting from a lucky hit on the correct digital logic family while browsing Zeptobars.  (See attached images below)

[peter-h]

So basically they are buying off the shelf dies of common chips and connecting them up in the hybrid.

Money no object

1981 date code.

[D Straney]

Yep, from my limited understanding that seemed like one of the main attractions of hybrid modules (besides being able to laser-trim resistors in-circuit) back in the days of large through-hole packaging: getting some serious miniaturization, but using off-the-shelf dies, without having to go through all the trouble of making fully-custom ICs for one-off applications.

Was wondering about the justification for hybrids in this application: they could've fit those 21 separate ICs plus a bunch of resistors & diodes on 2 boards, within the same overall enclosure, but I'm guessing the reliability standards rate macro-scale solder joints as much less reliable than wirebonds.  Shrinking it also makes passing vibration / shock tests a whole lot easier too I bet, vs. two stacked boards with a bunch of extra mass and connections between them.  Obviously it's 100% doable to make something out of individual ICs that would meet all the environmental & reliability requirements, but my best guess is that since this was just one very minor piece of the avionics, in the big scheme of things it wasn't worth the engineering effort to make that work - especially when only a few hundred are ever going to be made at most, it's not cost-sensitive like you say, and making hybrids seems like it was an established workflow for them and not something wildly new (MDEC = McDonnell Douglas Electronics Corp., made in-house at the same company, plus they did plenty of others like these, from a C-17 aircraft display: https://ocoautomation.com/12464-a69g0259-3-12464-a06a1041-4-circuit-board-t66164/).  Kind of like how for "low-effort" digital circuitry (sub-100-Mhz, >1 ns rise/fall times) it's easiest to just use a 4-layer board with a ground plane and throw a 100nF cap on every single power pin - sure, it's overkill most of the time, but who has the time to do a detailed investigation of transient power distribution behavior and find/exercise all the worst-case edge cases, when there's so many other more important things to spend time on?

[D Straney]

Ok, here's a couple boards which make a nice side-by-side comparison of how things have changed over time.  Both are from Westinghouse Defense, whose main business seemed to be radar systems.  They both seem to be part of the digital data processors for two different aircraft radars, one older (late-70's), and one newer (mid-90's).

Westinghouse radar processor board (70's)


This assembly is made up of two separate boards mounted to both sides of a common heatsink, with ports on the short sides for air-cooling:

The large backplane connector, with connections to the rest of the system, is wide enough to solder directly to both boards.  There's also a row of pads along the top edge of each board, likely as a test/debug connector (as I discussed earlier in this thread on the Raytheon submarine satellite terminal boards).  You can see these test pads more closely here:


The backplane connector's pins are visible below, along with some empty footprints. Each IC footprint has vias underneath the flatpack bodies for maximum layout compactness, similar to the layout style of the Saturn V LVDC and other late-60's/70's digital boards with a lot of flatpack ICs.  Like the LVDC boards, these are also multi-layer PCBs, with ground or power planes visible through the semi-transparent fiberglass.  I'm not sure how many total layers there are, but all the signal routing seems to be done on inner layers, again to allow placing the packages as close together as physically possible and minimizing the size.  There's also a strip of double-sided tape underneath each row of ICs, which is likely to hold down the IC bodies during soldering.  I'm assuming this was before reflow soldering, so despite being surface-mount connections there's a good chance these were all done by hand (correct me if I'm wrong!).


More importantly, though, what does this board do?  I looked up the part numbers from each side, and made some continuity checks (luckily these weren't conformal-coated), and have some educated guesses as a result.

"Multiplier side"

The main feature of this side is a large array of these 24-pin gold chips:

The official data on this part number, from aerospace parts suppliers, only shows that it's a digital multiplier, with no other info.  However, they've got AMD logos, so from looking at an AMD databook from the right era (thanks bitsavers!) and matching up the packaging, these seem to be the AM2505 or AM25L05.  See p.30 or p.36 in the 1974 databook if you're interested in details.  Each IC is a 2-bit x 4-bit multiplier, with an integrated adder so that it's easily-expandable to any input word size, just by making the appropriate-size block of these chips.  Here's a diagram from the databook showing how that works: the electrical layout is similar to doing multiplication by hand on paper, with multiple offset rows of results that get summed up.

Because of the relatively complicated internal circuitry for doing these multiplications, there's also different propagation times from each input to the final outputs.  The databook mentions that the connection scheme shown is chosen to minimize overall propagation delay through the entire multiplier array.

The number and arrangement of these ICs on this board suggests that they're being used to do 12-bit x 12-bit multiplication.  One of the 12-bit inputs comes from the group of 3x white packages with stickers here (one of which I removed).  These are PROMs, likely the Signetics 82S131 512x4.  The address pins are bussed together, so these form a lookup table that converts a 9-bit input from elsewhere, into a 12-bit number that gets sent to the multiplier.

It's possible that these implement a sine or cosine function, since multiplication by trig functions would be a common operation when tracking objects in 3D space.
The row of adder chips along the top edge of the board is used to sum up the final result from the two different halves of the multiplier array.  The XOR gates along the top row are wired as a "global output invert", which can optionally flip all the output bits, inverting the number's sign in 2's-complement binary notation.

All the various 54174 sets of D-type flip-flops are used to latch the data at various stages (at PROM output, at the outputs of each multiplier-array half, etc.).  This helps pipeline the lookup-and-multiply as a multi-clock-cycle operation, which keeps the system clock period from being limited by the huge combined propagation delay of the PROMs + multiplier arrays + adders.

The 3 adders in a row on the bottom edge seem to be standalone, connecting only to the backplane connector as an independent 12-bit adder.  Overall I'd guess that this board is part of the radar computer's ALU.

"RAM side"

The structure and purpose of this side are much less clear, and I wasn't able to figure out exactly what it does.  The unique parts on this side, the gold chips, are AMD AM91L02 1024 x 1-bit RAMs:

There's more of the white, stickered PROMs as well.  The PROMs and the RAMs sometimes have their address bits ganged together (to form 1024 x 2 to 1024 x 5 RAM arrays, for example) but other times don't; there's a big mix of different data widths to go with a stew of misc. logic gates in making things confusing, and to top it all off, there's an impressively-complicated sea of rework wires too:

I sure hope for the sake of those poor assembly techs that this was a prototype, and that production units didn't get this treatment.

Finally, the large white chip in the corner is either a PROM or PLA (programmable logic array): I wasn't able to narrow it down any further than that from the Signetics databook by pin count:


Origin
I found two conflicting trails when tracking this board's origins, both involving military aircraft radar.  The multiplier ICs are shown in an official parts database as having an end-use in the F-16 fighter jet.  Going by the dates, this would've likely been the Westinghouse AN/APG-66(V)2 or the AN/APG-68(V) radars: the '68 has a "Programmable Signal Processor" / "Common Radar Processor" which this could plausibly be a part of.

The 583R234H01 ICs, on the other hand (which have no definite function marked on the diagrams above but are most likely 54367 logic buffers) are supposedly used in "AN/ALQ-153/V/SUPPORT EQUIP".  The AN/ALQ-153 is a radar-based "Active Missile Approach Warning System", also made by Westinghouse, and used in a variety of planes (but not the F-16).  I don't know what kind of support equipment this would be, but if you look at an image of this radar's "digital signal processor", you can see the form factor looks roughly correct for this board.

It's also possible that this was a common board used in both these systems, or part of a larger digital signal processor used in both these radar systems - with Westinghouse making so many radars, especially around the same times, it would be surprising if they didn't re-use any of the more widely-applicable design work between multiple systems.

After looking at the other board, it's worth discussing what kinds of calculations and signal processing both of them were likely doing in the radar systems.

[D Straney]

Westinghouse radar processor board (90's)



The elephant(s) in the room here are the two large ceramic-and-gold QFPs, which are IDT memory chips, specifically the 7025 8K x 16 dual-port SRAMs.



There's also a somewhat-modern Xilinx FPGA, an XC3000-series part which has 484 CLBs (configurable logic blocks) & ~95 kbits of internal block RAM.


The mix of programmable logic styles is strange: besides the modern (relatively-)high-density FPGA, there's a lot of individual PLA (Programmable Logic Array) devices all over the board.  These have only a handful of configurable internal connections and are comparatively power-hungry; they were popular for condensing large blocks of individual SSI digital logic gate chips in the 70's and 80's, but lost their appeal when good & cheap CPLDs & FPGAs became widely available and easy to use.


This suggests to me that this is an update of an old design, where the FPGA is replacing some earlier block of circuitry, and the rest is kept the same as much as possible to ease qualification and testing.  Otherwise, with a design from scratch, I'm not sure why the extra logic from the PALs wouldn't have been integrated into the same FPGA (if there was enough space & I/O) or condensed into an identical-model 2nd FPGA to save space and weight.

Soldermask seems to be applied only on the back side of the board, and underneath the ICs (where it keeps the solder meant for IC pins from wandering down the exposed traces and getting into vias, during reflow):


I've noticed a lot of "hi-rel" aerospace stuff seems to be allergic to soldermask, and I'm not sure why.  Maybe it was seen as unnecessary, before the days of fine-pitch parts with tighter solder joint requirements, plus reflow soldering, the combination of which makes it pretty much essential.  Boards that get conformal coated would already be protected against conductive debris and moisture anyways, and soldermask might have been a unknown risk for contaminant absorption and conductivity over long lifetimes, before there was enough lifetime data?  On space equipment, at least, it makes sense to have one less potential source of offgassing with all the sensitive instruments and telescope mirrors nearby.

There's less parts here because of the much higher integration level, and nothing on the back side, so it's much easier to see what everything is:

I wasn't able to easily trace the connections here, but my best guess is that the rest of the board is centered around feeding data in and out of the FPGA, which is doing some kind of signal processing math, via the dual-port RAMs.  The PALs are likely providing "glue logic" to shuttle data in and out of the "external" side of the dual-port RAMs for the external CPU, or maybe do some kind of DMA.  The configuration PROM for the FPGA is visible, although I'm not sure what the FIFOs and general-purpose PROMs are doing.  (The FIFOs, at least, also seem to be involved with getting data in and out of the FPGA; the PROMs might be some sort of data tables or math coefficients?)

Origin
Based on dates, and the PAL part number showing the F-16 fighter jet as its "end use", this might be from the Westinghouse AN/APG-68(V)2A fire control radar, which is also noted as having "more powerful signal processing".  This matches up nicely with my "upgrade to a previous board revision" theory, based on the combined PAL & FPGA use.

Purpose
What kind of digital processing are these two boards made to do?  What has high enough processing power demands that it requires a hardware multiplier? (on the 70's board)

Target tracking: one of the most basic radar processing functions, for any kind of aircraft use (whether civil air traffic control or military), is tracking multiple targets.  Each radar pulse gives you a distance or multiple distances to targets at that specific antenna position; the antenna is then usually rotating its beam (either mechanically or electronically) so that each individual radar return ends up as a pair of polar coordinates: distance, and angle.

Directly plotting these points on a screen is only somewhat useful on its own: a much more useful way to represent the data to the operator is as individual objects, which persist between pulses or during an occasional missed return pulse.  There's also the issue of "clutter", or other (usually stationary) objects which reflect the radar pulse and clutter up the raw return data.  The best way to handle the target-tracking portion is by having a computer keep an internal list of targets.  On each radar sweep, the detected positions can be compared against the previous list of target positions, and new ones can be added.  The positions of previous targets can be updated, based on new return pulses that are close to their previous positions.  Keeping track of multiple targets as they move around in a dense environment is actually a non-trivial problem, and involves a lot of trigonometry and exponents (with the associated computing power requirements) to calculate 2D or 3D distances between points.  More involved target tracking can also predict each target's velocity vector based on previous radar pulses, and estimate where the target is expected to be on the next radar pulse, and therefore give better-quality results.  Each target, depending on size and shape, might not give a single clean return pulse, but multiple closely-spaced returns or smaller returns at adjacent angles, and so this "grouping" has to be combined when necessary into a single coherent target.  Radartutorial.eu has two pages (one and two) giving a better description.

This kind of detailed target tracking is also useful for removing any radar returns that are stationary relative to the ground, such as trees, hills, and other terrain features when not desired.  Even figuring out whether a target is stationary on the ground or not requires a lot of trig and sensor data about the plane's ground speed.

The 70's radar data processor is likely doing a lot of this type of math.  The more RF-oriented functions described below I'd guess are still done all-analog at that point.

RF pulse processing: once you can digitize the raw RF receive data, you can do a whole lot more advanced processing on it in the digital domain: hence, the popularity now of giant Virtex FPGAs and expensive e2v high-speed direct-RF-sampling ADCs for military applications.  The 90's radar data processor probably isn't sampling the RF return pulses directly: however, it might be digitizing downconverted copies of the return pulses, rather than measuring the return pulse presence and timing all with analog circuitry.

Things you can do with digital processing of the return pulses include:

• target recognition, by looking at the shape and return pattern of the pulses (this might've even been done on the 70's unit, by looking at pre-downconverted-and-received amplitude/frequency data)
• improved range resolution and robustness, by using uniquely-shaped pulses with digital receive filters matched exactly to the pulse shapes (this would particularly help if there are multiple radars operating in the area on the same frequencies)
• direct target speed measurement, by looking at frequency offset and therefore Doppler shift
• "frequency diversity", aka, using multiple frequencies at once with variable delays and combining algorithms to resist jamming and improve robustness

A lot of these functions could be implemented fully-analog, but are either easier or much more powerful when done digitally.  Digital filters in particular can be made with much sharper roll-offs, as you can implement a 20-pole filter no problem: if trying to do that with discrete components, the tolerance stackups and thermal drift get in the way.

Anyways, hope this was informative.