Advantest R3273 / R3267 Repair

[chick0n]

Hi folks,

I sketched some time ago the schematic of the BLC024864, I attached it as a pdf file. It is not looking very nice, but at that time it was good enough for me to repair mine. It si a simple voltage filter, which makes silent power supply lines for the RF part. In my unit, one 39 kOhm divider resistor was simply interrupted. It is not exposed to high voltages or currents, it simply gives up. After replacement all my RF voltages were fine. But as it was stated above, I also skipped the filter board as a first step, and looped the voltages back to the RF module. Just after that I started to find the problem on the module itself.

My R3267 units have flash ROMs, and no CF cards inside. The main CPU boards are different from the R3273, which indeed has the firmware on a CF card (pictures of the two sides of one of my R3267 attached).
@Chick0n: if you need some measurements on the main CPU boards connectors/interfaces, please let me know. I will try to do them in one of the following weekends.

BR,
Gyorgy

Thanks for the Schematic!

Do you Measure the same Voltages as me on the Voltage Filter? About 12.7V Input and 11.7V Output?

[chick0n]

After Disassembling the MAINTE.X, I found 3 ocurrences of "882323":

ROM:0000D016                      cmpi.l  #882323,0(a0)
ROM:0000D0C0                      cmpi.l  #882323,0(a0)
ROM:0000D184                      cmpi.l  #882323,0(a0)

One for each hidden menu? Except, for "SHIFT + Transient", nothing happens.

So maybe the Password is Correct, and something is missing for triggering the debug menu, or the menu gets triggered somewhere else?

[Gyorgy Albert]

Maybe a dipswitch setting is required ( under the backplate). The eeprom write must be also enabled by a dipswitch, so this could be similar. You have a Write protection in the software menus, but it will work only if the dipswitch is set. It worth a try using the unknown dipswitch items. Some are already identified, if I remember, one or two are used to route different signals to the backpanel BNC socket. So the remaining could be what we are looking for.

[chick0n]

Maybe a dipswitch setting is required ( under the backplate). The eeprom write must be also enabled by a dipswitch, so this could be similar. You have a Write protection in the software menus, but it will work only if the dipswitch is set. It worth a try using the unknown dipswitch items. Some are already identified, if I remember, one or two are used to route different signals to the backpanel BNC socket. So the remaining could be what we are looking for.

Already tried the dip switches on cpu board and backpanel. 

[Gyorgy Albert]

Maybe a floppy disk must be inserted and detected by the system. Just a thought.   

[chick0n]

Maybe a floppy disk must be inserted and detected by the system. Just a thought.   

yep...I thought that too...

Also, when you switch dip switch 1 on the cpu board on, it asks for a boot disk.

[Gyorgy Albert]

I double checked the backpanel dipswitch. Only 1,5 and 6 are used, the others are not connected. So there is nothing else to look for here, we know the functions of these settings ( it is marked in fact on the silkscreen of the printed circuit board BLC-024514). The conditional access to the special menu is hidden somewhere else. Maybe a floppy disk with some special content is needed ( not a boot disk, since we are looking for some software option settings, and maybe the disk should contain some option files, which should be transferred in this menu to the compact flash, or flash memory in the case of analyzers without compact flash).
In one of the other topics related to the R3273, someone wrote about a serial port available on the main CPU board( some messages were listed during the ooer up). Maybe this can be used as a terminal, and there you can send special maintenance commands. However, all these should work also over GPIB.

[chick0n]

I connected to the J12 connector on cpu board. Pin1 is TX, 2 maybe RX?, 3 GND, rest is GND and 5V.

I was never able to send commands.

I received some boot messages, and when the analyzer is bootet up it writes SD:/SD:/SD:/SD:/SD:/SD:/SD:/SD:/ over and over again...

When I type "shift + window + 882323 + hz", it sends "CW KEY SET" over rs232.

When I type wrong password, nothing...

In the MAINTE.X, I found Strings:

CW KEY SET
CW KEY DEL
DFM KEY is Invalid.
DFM KEY is not Delete.

[Gyorgy Albert]

The serial port will be good for monitoring/debugging. Whe you try the hidden menu SHIFT + TRANSIENT +882323+Hz, does it report anything on the serial? I have to connect my analyzer to a serial port in the weekend and play a bit. Are there any other operations ( for example in the maintenance menues) reported over the serial?

[chick0n]

I also found, the DSP-Board has a own Maintenance Mode. But I dont know how to access.

[chick0n]

I checked on the low signal problem again.

Everything is back to stock...Voltage Regulator is in...

I applied -10dbm CAL Signal to analyzer input, set analyzer to zero span... shows as -50dbm on analyzer.

I disconnected the connection between 1st mixer output and 2nd mixer input. Then I connected Power Sensor to 1st mixer output. Shows about -13dbm at 4,3GHz....

Then I set microwave source to 4,3GHz -13dbm, and injected to 2nd mixer input. Analyzer Shows -13dbm correctly. 

Then I reconnected 1st mixer to 2nd mixer. Analyzer shows -50dbm again... 

I dont know whats right or wrong in this world anymore...

[Gyorgy Albert]

Your power meter is a broadband device, I mean it is not a selective receiver. You can measure the -13 dBm level, but it does not mean that the carrier frequency which cames out from the 1st IF  it is there where it should be (a relatively small frequency deviation could be enough, to measure a low level. Of course all these will also depend on the selected RBW). Try to feed from the external generator (which preferably is connected to the same reference clock as the analyzer) a 30 MHz -10dBm signal to the input of the analyzer. If this works, and you will measure a correct level, it means that your 30 MHz CAL signal is out of sync, and it is not at 30 MHz (which would be a bit strange). If this doesn't work either, than you might have a shift in the frequency of the first local oscillator. Which is possible, even if it seems locked. The phase lock of the YIG is a multi loop PLL, with several conversions, and if you change some settings in the maintenance mode, you can easily detune it (and will be locked to a shifted frequency. But if you have not changed the settings in the maintenance mode, this should not be the case). So you have to find out 2 things: if your CAL signal is sharply 30 MHz, and if your 1st LO is spot on the right frequency. They both are locked to the 10 MHz reference frequency.

Also please note: The 4.1 GHz IF is used only for the low frequency band (if I am right below 3.5 GHz). For higher frequencies it is skipped, and the IF is directly 421 MHz. Eventually, check the RF path measured level, with some RF signal in the higher bands (above 4 GHz). Just to be sure, that this path which does not use the 4.1GHz IF is working or not.

[chick0n]

Youre right, with Power Meter I measure all "Peaks" in the Spectrum at the same time... Also I "misused" the Scalar Detector of my Marconi 6203 as Power Sensor, because it is more Sensitive.

I checked the cal signal with a good analyzer. Its OK.

My freq. Counter and Microwave source are synched to the R3273 Ref.

I connected the 1st mixer IF out to the counter, it measures exactly 4.23154GHz. So the strongest Peak on the 1st mixer output seems about correct. (Service Manual says 1st IF is 4.2314GHz)

Also, the "torque" of the screws on the 1st mixer lid make a difference in output power. All screws tight = -23dbm. Loosing some screws = -13dbm. Lid open = -27dbm.

[chick0n]

Ok...I measured again with the 4.5Ghz Low Pass Filter in place at the IF Out.

I think, what happens is, sometimes the counter catches the YTO-LO frequency at the IF Out (~4.26142GHz), and sometimes it catches the IF frequency (4,23154GHz).

The Power Sensor measures both, and maybe more Mixer Products...

The IF gets filtered better at a later stage, with a Bandpass Filter.

[chick0n]

Today I found out, SHIFT + TRANSIENT + 882323 + Hz, does indeed Trigger a hidden menu.

Its the Maintenance mode of the DSP-Card. You can acces under CONFIG - Comm Sys. - Maintenance.

Smacks on forehead... 

So we finally got that sorted out...and we know definately, the Debug Menu gets triggered somewhere else...

[chick0n]

I think the culprit is in the 2nd Mixer Stage.

When I Power the whole RF-Block with the Voltage Filter (11.5Volt), EXCEPT for the Blue Cable over the 91Ohm Resistor (Where I inject 12.5V). The Analyzer shows me the -10dBm Cal Signal as -21dBm (Uncalibrated).
This is the same, as if I Power the whole block with 12.5V. With this, I can get the Analyzer to Self Calibrate...

This is the BIAS voltage for the "E5" IC (I think this is a Minicircuits ERA-5 MMIC. Is it?)

The Problem is, the ERA-5 Datasheet says, it needs about 5V BIAS Voltage. So with 11 to 12V over the 91Ohm Resistor, it should be about 5V at Pin3 of ERA-5.

BUT I measure between 9.7 to 10.4 Volts at Pin3. So ERA-5 is toast?

The resistor measures OK.

[Gyorgy Albert]

@jjoonathan

I am not mastering python, but what I understand that you have identified the eeprom structure, which holds the frequency calibration data. Can you detail a bit, how did you find that?
And what I concluded: you removed the eeprom from the RF deck, and read out the content. After your RF path (attenuator) measurements, you wrote the corrected coefficients to the eeprom. I am right in this matter?

I am very interested in this topic, since I would like to calibrate mine too, but I am looking to find an easyer way, to read it out through GPIB (no good results yet, but I am still working on it), and avoid the disassembly of the RF deck, and unsolder the eeprom. Probably the $R and $W GPIB commands, as I figured out, will help doing this

I would really appreciate your help.
Thanks,
Gyorgy

[jjoonathan]

I disconnected the digitizer IF input coming from the frequency converters and instead applied a constant tone from a signal generator. Then I used GPIB to read the measured amplitude at 10,000 points or something -- effectively this gave me the calibration trace. It used linear interpolation, so the high resolution trace clearly indicated both the frequencies and amplitudes of the correction table (inflection points). Now that I had the correction table, I created a script to try all "origin/offset/encoding" triples and look for strong correlation. I didn't find anything on the CF card, so I looked harder for EEPROMs and eventually found the EEPROM on the RF deck. The search script found (IIRC) 8 hits corresponding to 8 settings of the input attenuator.

With luck, you might be able to use the EEPROM dumps in my dropbox to locate EEPROM in the memory map with $R and then use $W to update the calibration values. Please let us know how it goes! 

[chick0n]

I think the culprit is in the 2nd Mixer Stage.

When I Power the whole RF-Block with the Voltage Filter (11.5Volt), EXCEPT for the Blue Cable over the 91Ohm Resistor (Where I inject 12.5V). The Analyzer shows me the -10dBm Cal Signal as -21dBm (Uncalibrated).
This is the same, as if I Power the whole block with 12.5V. With this, I can get the Analyzer to Self Calibrate...

This is the BIAS voltage for the "E5" IC (I think this is a Minicircuits ERA-5 MMIC. Is it?)

The Problem is, the ERA-5 Datasheet says, it needs about 5V BIAS Voltage. So with 11 to 12V over the 91Ohm Resistor, it should be about 5V at Pin3 of ERA-5.

BUT I measure between 9.7 to 10.4 Volts at Pin3. So ERA-5 is toast?

The resistor measures OK.

I replaced the ERA-5. (BIAS Voltage of 4.8V seems perfect) And its working now. Frequency Response from 10MHz to 3.5GHz is very good now. Over 3.5GHz its a bit over the place, maybe because the YTF Calibration is wrong, but seems solvable with a little tweaking. Also the the Step Attenuator was replaced, so the Frequency Correction is wrong.

But for the Price I got the analyzer for, im pretty pleased.

Another little problem is the BIAS Voltage for the first mixer Diode (See Picture). When I connect it, the input Signal degrades. Disconnected everything seems fine.

I have 2 RF-Decks with this same problem here, and  I heard from others who have this problem.

The Diode marked "D2V", seems to be a HSMP-3802 double PIN Diode, where just one Diode is used. It measures OK in the component tester.

Mixer Diode seems OK too.

[chick0n]

I made Firmware with all software options, for R3267/73. You need hardware option 01, to use the software options.
Just delete the old files from your cf card, and copy the new ones.
Dont format your CF-Card with Windows!!
Should work for R3273, R3267 with CF-Card and maybe R3264.
Im still looking for Firmwares higher than I08. Im especially looking for firmware from analyzer with "OPT.05 Audio Demodulation Output Option", to check if this is hardware or software option.

Maybe some Options are useful for Hobby use.. Especially with the AMPS Option, you can measure FM-Deviation and SINAD.

Options:

Code: [Select]

OPT61: IS-95  [A08] Aug 08 2001
 
 OPT62: 3GPP   [J02] Nov 08 2004
 
 OPT63: GSM/DECT [D01] Jul 08 2003
 
 OPT64: PDC/PHS/IS-136 [B04] Jul 25 2000
 
 OPT65: cdma2000 [D00] Jan 24 2003
 
 OPT66: Bluetooth [C02] Jul 08 2003
 
 OPT67: HDR    [E00] Jun 28 2004
 
 OPT69: HDR(MS)[B00] Jun 28 2004    
 
 OPT73: AMPS/JTACS/NTACS [A05] Aug 08 2001


[serg-el]

It seems to me, or is there a crack from the fastening of the plate, and down to the right diagonally?

[chick0n]

It seems to me, or is there a crack from the fastening of the plate, and down to the right diagonally?

Thanks..I checked it...and this picture is not from my analyzer. I borrowed it from "3g57", on the forum.

I found another picture, from a R3267. There the BIAS Circuit was never connected... Weird...

As I understand, the RF deck of the R3267 is the same as the R3273. Especially the first mixer for the low band. Only the High Band mixer goes up to to 8GHz, instead of 26GHz.


I have 2 assumptions about this circuit:

1. BIAS Voltage for the mixer diode, to compensate for the LO output power fluctuations.

2. In the R3271 Service Manual, a similar circuit is described. There a BIAS TEE is used to prevent the IF from the High Band mixer (421MHz) leaking to the low band. How this works I dont know...

[chick0n]

Im trying to tune the YTF / High Band Mixer in the cal menu, with my Marconi 6203 Microwave Source. Looks promising.

This is YTF Band 1 from 3.7 to 7.4 GHz, sweeped at -10dBm. Before and after coarse tuning attempts.

The traces are looking crappy, because the Marconi isnt synched to the R3273.

[ginji]

Dear chic0n

Thanks to this blog, I was able to repair my R3267, thank you very much.
After investigating the cause, it turned out that there was a problem with the 1st IF or the 2nd IF. When the SSG signal was applied to the 2nd IFin of 421.4MHz, the level was normal.
After looking at this blog, I measured the voltage at pin 3 of the ERA-5 and it was 11.2V, so I knew the ERA-5 was dead.
I ordered ERA-5SM, and I got it cheaply at ¥210/piece.
I installed the ERA-5SM and it was a perfect repair.
The voltage after installation is 4.7V.
Thank you very much.

ginji

[ginji]

Added, low level problem of R3267.