Advantest R3273 / R3267 Repair

[chick0n]

This first problem is solved, or where non existant.

Scroll down for more problems.

[chick0n]

Some Pictures: https://ibb.co/album/xqNvf6


Some stuff I found out: (With help of other people on the Forum)

- After you Disconnect / Change the NVRAM Lithium battery, the trace wents to the top of the LCD in full span mode.

Solution: You have to turn off the analyzer and hold the "." dot key, while turning on, during the whole bootup process. This initializes the NVRAM, and everything is back to normal.


- When you want to use a new CF card, you need a 8 or 16MB card, and format it with this tool:
https://www.sdcard.org/downloads/formatter/
Then copy the files on it. Nothing else worked for me.


- After pressing: "Shift + Format + 882323 + Hz", you can reset "ATT switch count" and "Power ON switch count".


- After pressing: "SHIFT + WINDOW + 882323 + Hz", you enter the calibration menu, where you can read/write/tweak every calibration value. So you dont need some unobtainium PC Software like with R&S Machines. (Thank you Advantest
When you want to save the changes to the EEPROM, you need to remove the small backplate assembly, with the 4 screws. There is a DIP Switch, where you can turn EEPROMWRITE on.


- Pressing SHIFT + TRANSIENT will also ask for a password, but it is not known yet. I think this is the access to the debug mode. I found some interesting strings in the firmware:

DFM.txt: --- Read memory ----------------
DFM.txt:                                     
DFM.txt:              DEBUG MODE             
DFM.txt:             TBC SEND 595           
DFM.txt:             TBC SEND DAC           
DFM.txt:           TBC SEND DAC 500         
DFM.txt:             TBC SEND CXD           
DFM.txt:          TBC SEND 87086/16         
DFM.txt:          TBC SEND 87086/20         
DFM.txt:           TBC SEND AD7008           
DFM.txt:            TBC READ 0831           
DFM.txt:           TBC EEPROM WRITE         
DFM.txt:           TBC EEPROM READ           
DFM.txt:            TBC SRAM WRITE           
DFM.txt:            TBC SRAM READ           
DFM.txt: DEBUG MODE
DFM.txt: Standard
DFM.txt: TBC|Send xxx
DFM.txt: TBC|Read 0831
DFM.txt: TBC|EEPROM xxx
DFM.txt: TBC|D.P.M xxx
DFM.txt: return
DFM.txt: STANDARD
DFM.txt: ACTIVE
DFM.txt: address| write
DFM.txt: FORMAT
DFM.txt: Hex|Dec
DFM.txt: SIZE TYPE
DFM.txt: 8|16|32
DFM.txt: Read Loop
DFM.txt: Write Loop
DFM.txt: return
DFM.txt: SEND 1/2
DFM.txt: TBC|Send 595
DFM.txt: TBC|Send DAC
DFM.txt: TBC|Send DAC5
DFM.txt: TBC|Send CXD
DFM.txt: TBC|Send 7008
DFM.txt: next menu
DFM.txt: return
DFM.txt: SEND 2/2
DFM.txt: TBC|Send 87086|/16
DFM.txt: TBC|Send 87086|/20
DFM.txt: prev menu
DFM.txt: TBC EEPROM
DFM.txt: TBC|EP Write
DFM.txt: TBC|EP Read
DFM.txt: return
DFM.txt: LOCAL BUS
DFM.txt: TBC|SRAM Write
DFM.txt: TBC|SRAM Read
DFM.txt: return
DFM.txt: DEBUG TBC
DFM.txt: ACTIVE
DFM.txt: address| write
DFM.txt: Write Loop
DFM.txt: return
DFM.txt: DEBUG TBC
DFM.txt: ACTIVE
DFM.txt: address| write
DFM.txt: Read Loop
DFM.txt: return
DFM.txt: DEBUG TBC
DFM.txt: ACTIVE
DFM.txt:  ID |sorc|dest|size
DFM.txt: Execute
DFM.txt: return

I searched all firmware files for the passwords, but could not even find "882323", which is the same as for the R3131A.
I wonder how they are encoded?

- There even exist a tool on the cf card (TBC.X), to read/write the calibration values as .csv files. But I dont know how to execute it. (Maybe through  Debug Mode)


I attached my CF-Card content, and I even Read out the TSOP Flash-EPROM on the CPU Board. Maybe anyone can find the Debug mode password.


The Operating System is called VRTX-32 from Mentor Graphics. I think the kernel runs on the Flash-Eprom, and the executables are on the CF-Card.

Also VRTX runs the Hubble Space Telescope.

CF Card Content: https://drive.google.com/file/d/1XZMoc3Zd86UlXWMjUhN6VH5KTtQ_qpTr/view

Also: Broken TG Fix: Oh Boy.... 

[chick0n]

Other Problems:

The -10dbm 30MHz Calibration Signal is OK. But when I connect it to the input, the analyzer reads it as 0dbm. This is only in the first minutes of operation, when the analyzer is still cold.

When the analyzer is warming up for a few minutes, suddenly the noisefloor drops a little bit, and the 30MHz signals then gets read as about -37dbm.

Both readings are either too high or too low, to be recognized in the calibration routine or selftest.

Sometimes the calibration routine catches the signal, and tries to calibrate for a few seconds. But then it freezes. and I have to press preset to reset the analyzer.

When the selftest catches the signal, everything fails, except the CPU and Synthe Block test.

When I look in the maintenance menu, at the system status, it complains about the RF and IF Output level. (See Photo)

Ignore the "Reference PLL" failure, I got that fixed already...

Also the Option 01 DSP Board doesnt get detected. But maybe it is really broken, and this isnt a bus communication error. I will try to deactivate this option, since its "only" a Signal Analyzer for old Mobile Standarts like cdma2000 and stuff....

[chick0n]

I investigated a little bit further today, and tested the IF / Mixer stages.

I set the analyzer to zero span, and injected a 21.4MHz signal (3rd IF) into the IF Card. The dbm level reads about right.

Then I injected 421MHz (2nd IF Signal) into the 3rd Mixer. The level reads ok too.

Then I injected 4231.4MHz (1st IF Signal) into the second mixer. And there the strange behaviour begins to show. The signal level degrades over the course of a few seconds.

So the problems seems to lay in the 2nd Mixer. I treated the area with cooler spray and heat, but nothing changed.

Maybe the problem lays in the steering of the mixer on the underside of the RF block.

The PLL seems to work...

Maybe its a digital problem...

[chick0n]

Also the last owner soldered around Q100. This is the amplifier stage for the 1st IF Signal.

The gaasfet looks like a NE32584C, so I ordered a new one.

[AJ3G]

That is some poor soldering technique the previous technician used! 

Great Posts, I have a 3267 here that has a sick TG. Need to see what is going on with it. Keep up providing this information, it’s very useful!

Rich

[chick0n]

That is some poor soldering technique the previous technician used! 

Great Posts, I have a 3267 here that has a sick TG. Need to see what is going on with it. Keep up providing this information, it’s very useful!

Rich

Thanks.

Maybe you could take the measurements i mentioned in the first post for me?

The Cpu Boards of R3267 / 73 are the same.

[chick0n]

WOW...I got a BIG Problem solved today.

It seems the "Filter Board" is broken. (See Picture)

While checking the analyzer, and whiggling around the connectors, I accidentally short-circuited the filter board, which completely destroyed it. (The 30MHz peak was very small now, around -70dbm instead of -10)

First I thought, this is game over for this analyzer now...

Then I found out, you can bridge the filter board completely. I think the Board filters the supply voltages and some signals to the RF Block, I think. The RF-Block has two 10Pin connectors for the filter, which are the same. So you can put in a jumper cable.

I turned the Analyzer on, and:

30MHz Signal is strong now.

- CAL-Routine passes completely, without freezing.
- Selftest passes completely, without errors.
- DSP-MOD Board gets detected.

3 problems solved.

The 30MHz -10dbm cal signal reads as -6dbm, after calibration. Which is a highly accurate reading for this mess of an analyzer...

Tomorrow I will make further tests.

I dont know how, and what this Filter actually Filters.

It consists of 4 AD822AR OP Amps, 3 2sd1584 NPN Transistors, and 3 2sa1615 PNP Transistors.

One 2sd1584 is broken, and some ADs too, because they get hot.

You can still buy the ADs, but the Transistors are almost unobtainium.

[dxl]

WOW...I got a BIG Problem solved today.

It seems the "Filter Board" is broken. (See Picture)


I dont know how, and what this Filter actually Filters.

It consists of 4 AD822AR OP Amps, 3 2sd1584 NPN Transistors, and 3 2sa1615 PNP Transistors.

Maybe this is just a voltage regulator board? At least the combination OPAMP - (bigger) Transistors and Caps make me suspect that.

[chick0n]

Maybe it regulates the voltages slightly, to keep it constant and precise for the RF-Block.

Also the PCB is mountet behind the front panel. Away from heat sources.

[chick0n]

I played a little bit more today.

I first thought, the High Band Mixer (TOP2301) is completely toast. This little block is responsible for the 3.5 to 26.5GHz range.

It is a combined YIG Filter and Harmonics Mixer. It can also pass through the low band (100HZ to 3.5GHz). It mixes the High Band right down to 421MHz.

I got very low readings from 4 to 8GHz, and nothing beyond that, at first. After twiddling around in the maintenance menu, I now get strong peaks from 3.5 to 26.5GHz. Not correct readings, but I can "see" up to 26GHz now.

It seems, the mixer was a little bit out of calibration, or some previous owner swapped it.

Non the less, a good calibration manual for the R3273 would be nice to have...

[chick0n]

I examined the "Filter" board some more.

Its really are "just" 6 Voltage Regulators.

It takes +12.6V and -12.6V at the Input, splits it to 3x +12.6V and 3x -12.6V, to each Regulator.

At the Output, I get 6 times +-11.7 Volts. 

One 12V Voltage is missing, because the Transistor is broken. And one AD822 gets really hot. I will try to repair it. Or maybe build a new one?

Maybe Advantest calls it Filter-Board, because the Voltage stays about the same, but the output is more clean and stable.


Also, I fine-tuned the YTF. I get constant readings now, on the full range to 26.5GHz. 

The Amplitude still reads too high, but hey... 

[dxl]

Also, I fine-tuned the YTF. I get constant readings now, on the full range to 26.5GHz. 

I would have tried to repair the board first before doing any adjustments - are you sure that the YTF adjustment is wrong? Maybe the values it depend on the addtional voltage drop from the regulator? Do you still have the original values?

[chick0n]

Also, I fine-tuned the YTF. I get constant readings now, on the full range to 26.5GHz. 

I would have tried to repair the board first before doing any adjustments - are you sure that the YTF adjustment is wrong? Maybe the values it depend on the addtional voltage drop from the regulator? Do you still have the original values?

Yes...I made photos of almost all calibration values.

With the password for the Debug Mode, one could save calibration values as .csv files. And save as backup, or edit in excel. That would be really cool...

[chick0n]

Yesterday the CPU-Board died again.  I guess it has been Resoldered too often.

So I need to wait till someone sells me an R3267 / 73 CPU-Board. Or wait till a parts Machine pops up.

[chick0n]

After some Reflowing, the CPU-Board is Booting again. 

But now, the Amplitude problem is showing again.

When the Analyzer is cold, it shows the -10dbm cal signal as +2dbm, thats too much for the cal routine.

After warm up, the whole Trace on the LCD drops (Not just the Peak getting smaller), and shows the signal as -22dbm.

Whats really weird is, that the drop only shows after preset, or reboot. Which makes debugging extra hard...

I measured the converter stage outputs again, after cold and warm (preset) state.

1st converter cold: -21dbm, warm: -20dbm

2nd converter cold: -18dbm, warm: -15.4dbm

3rd converter cold: +6,2dbm, warm: -21.8dbm (wow)

[chick0n]

Further investigation:

I dont think, the 3rd converter is broken. (Would be too easy)

Theres some gain control voltage for the 3rd output transistor, that looks fishy.

Voltage Cold: -5V (Shows +2dbm on analyzer)

Voltage Warm (after Preset) -1,6~V (Shows -22dbm on analyzer)

When I disconnect cable to the transistor, Voltage is -12V

When I put in about -3.3V, from external power supply, analyzer shows -10dbm. The Cal Routine almost passes, but fails at the end. (She wants to adjust the control voltage herself?)

The control voltage comes from the underside of the RF-Block, which makes debugging extra hard....

[chick0n]

I have the sneaking suspicion, my attenuator is crimped wrong.

The Owner before me replaced it, and it works. But hmm...

Does anyone have a picture from the underside of the R3273 RF-Deck?

[serg-el]

No photos.  Calibration guide is available.
https://cloud.mail.ru/public/gG8r/DzJXmPxig

[chick0n]

Ok..false alarm. The attenuator is connected correctly.

And I have working CPU-Board now.

The fix for "-10dbm CAL Signal showing as -40dbm on the analyzer", is bridging the Voltage Regulator, for now. (The RF Block gets 12.7V instead of 11.7V). Something seems to have degraded in the RF-Block over the years. And its not the Electrolytics, I changed every one of them. Made no difference.

For me the Signal was still a little bit too low, to start calibration. Theres a 2db Attenuator in the RF input path (before the 3,6GHz Low Pass Filter), that I replaced with a 1db one. Now everything seems works fine.

I have to let the analyzer heat up for at least 30min before doing calibration or measurements.

[jjoonathan]

Hi! Glad to see I'm not the only one to experience the BROKEN tracking generator 

As for the underside of the RF deck, I do have pictures, because that's where the frequency response calibration EEPROM is. I also have a python class that knows how to read and write frequency response calibration values. Here:

https://www.dropbox.com/sh/duiwlludrlxyala/AACnrKwy0W6_VMswptNcmWIVa?dl=0

The RF deck EEPROM is in a really obnoxious location, so it would be nice if you figured out how to do it through GPIB instead. The most promising lead I know on that front is the $R/$W GPIB commands from the older R3371. The Advantest mailing list figured them out after I did things the hard way, of course -- but maybe they can help you!

Code: [Select]

# $R is READ
# $W is WRITE    [url]https://groups.io/g/advantestinstrument/message/1545[/url]

allData = b''
print('Start reading %s words' % n)
for a in range(0, n):
    address = str(format(start_adr+(a * 2), '02x'))
    data = Device.query('$R%s' % address).strip("\n")
    print(address, '\t', data)
    allData = allData + binascii.unhexlify(data.strip())

Program to concatenate:
[url]https://groups.io/g/advantestinstrument/message/1526[/url]

EDIT: fix link

[chick0n]

Hi! Glad to see I'm not the only one to experience the BROKEN tracking generator 

As for the underside of the RF deck, I do have pictures, because that's where the frequency response calibration EEPROM is. I also have a python class that knows how to read and write frequency response calibration values. Here:

https://www.dropbox.com/sh/duiwlludrlxyala/AACnrKwy0W6_VMswptNcmWIVa?dl=0

The RF deck EEPROM is in a really obnoxious location, so it would be nice if you figured out how to do it through GPIB instead. The most promising lead I know on that front is the $R/$W GPIB commands from the older R3371. The Advantest mailing list figured them out after I did things the hard way, of course -- but maybe they can help you!

Code: [Select]

# $R is READ
# $W is WRITE    [url]https://groups.io/g/advantestinstrument/message/1545[/url]

allData = b''
print('Start reading %s words' % n)
for a in range(0, n):
    address = str(format(start_adr+(a * 2), '02x'))
    data = Device.query('$R%s' % address).strip("\n")
    print(address, '\t', data)
    allData = allData + binascii.unhexlify(data.strip())

Program to concatenate:
[url]https://groups.io/g/advantestinstrument/message/1526[/url]

EDIT: fix link

For the R3273, its little bit different.

There are two Hidden Menus. In one menu, you can tweak the calibration values directly from the front panel. For this menu, the Password is known.

The other one is the Debug Menu, with this you can read and write the whole memory map. And you can save the Calibration Values as .csv files on the CF-Card. (every module in R3273, has its own eeprom with cal values). Unfortunately, the Password for the Debug Menu is not known yet, so no one was able to test this yet.

"csv" sounds like, the analyzer converts the eeprom content directly into human readable form.

The passwords for the menus are not stored in ASCII form, but encoded with alghoritm? Decoding this exceeds my skills....

[jjoonathan]

I never figured out the second password, but I did calibrate the frequency response on two R3273s with r3273.py. It works.

[chick0n]

I never figured out the second password, but I did calibrate the frequency response on two R3273s with r3273.py. It works.

Sorry... i didnt see the dropbox link first.

That looks very helpful. My r3273 could use a Step Attenuator calibration too. But I have to figure out how to get this running...

Also, the Attenuator crimping looks identical to mine. Thanks.

[Gyorgy Albert]

Hi folks,

I sketched some time ago the schematic of the BLC024864, I attached it as a pdf file. It is not looking very nice, but at that time it was good enough for me to repair mine. It si a simple voltage filter, which makes silent power supply lines for the RF part. In my unit, one 39 kOhm divider resistor was simply interrupted. It is not exposed to high voltages or currents, it simply gives up. After replacement all my RF voltages were fine. But as it was stated above, I also skipped the filter board as a first step, and looped the voltages back to the RF module. Just after that I started to find the problem on the module itself.

My R3267 units have flash ROMs, and no CF cards inside. The main CPU boards are different from the R3273, which indeed has the firmware on a CF card (pictures of the two sides of one of my R3267 attached).
@Chick0n: if you need some measurements on the main CPU boards connectors/interfaces, please let me know. I will try to do them in one of the following weekends.

BR,
Gyorgy