Anyone with R&S CRTU-RU experience? (WTF is this thing anyways...)

[Neganur]

I don't find it problematic that the unit supposedly uses a DOS based thing to run signalling/layer/basestation specific operations. There is no need for a UI in that regard since the user is not punching in those commands on the front panel of the device anyway. Anite and HP equivalent machines run just the same, you send AT commands to cell phones - it's what those devices use *shrug*
All those test cases are well defined by the European standards. Basic instrument functions will surely be available via the front panel, no DOS needed.

I also don't quite understand what anyone would want to achieve by "hacking" the unit. To what purpose? (for fun maybe)

[Wuerstchenhund]

I don't find it problematic that the unit supposedly uses a DOS based thing to run signalling/layer/basestation specific operations. There is no need for a UI in that regard since the user is not punching in those commands on the front panel of the device anyway.

There is an UI (running on DOS) because the user still has to make configurations for the test environment and at some point also might want to read some test results or measurements, and especially on the CMU200 yes, the user is using the UI to set up the various tests (on the CRTU the automated tests are configured on the device under Windows2000).

But yes, DOS isn't an issue because it only runs the UI anyways, all the work is done by individual DSPs in the various modules. The only problem is with units with FMR5 controllers (with AMD K5 processor) which impact the measurement performance. Later models with FMR6 (intel Celeron) or FMR7 (intel Celeron M) don't have these problems.

Anite and HP equivalent machines run just the same

No, not really. For example, the HP/Agilent/Keysight E5515 (aka 8960 Series 10) runs VxWorks. Again with a very versatile UI.

I don't know what OS the Anritsu testers use but they also come with an (ugly) UI.

I also don't quite understand what anyone would want to achieve by "hacking" the unit. To what purpose? (for fun maybe)

I assume the intention was to crack the software so that non-licensed functionality could be activated, or to replace the R&S software with something else that makes the CRTU into a normal test instrument.

Neither of them are viable routes in my opinion.

[tmbinc]

There's little information on the CRTU-RU out there; I can't wait to see a teardown. For the CMU 200, it's a bit better, but I don't know how much of the architecture they share.

Here's the service manual for the CMU200: https://www.ntecusa.com/docs/RS_CMU200_CMU300_other.pdf ; section 3 has a block diagram. If we compare this with the "block diagram" in http://cdn.rohde-schwarz.com/pws/dl_downloads/dl_common_library/dl_news_from_rs/magazin/Neues171_englisch_72dpi.pdf (which also claims that the CRTU-RU uses the same RF components as the CMU200), then we can draw the following conclusions:

• The CRTU-RU is basically a two-channel (2x RX, 2x TX) CMU200.
• Each channel features a fully tunable 10MHz-2.7GHz receiver/transmitter, working on a 10.7MHz (RX) / 13.85MHz (TX) IF. Not sure what the baseband bandwidth eventually is.
• But it gets better; on the "digital board", there's an ADC/DAC stage already. Everything further works on this digital data. (There's an optional hook for the I/Q analog data with the option CRTU-B7; it appears that it contains a separate DAC to get the digital I/Q RX back to analog, and just passes through the TX I/Q via a switch.)
• It's a bit unclear whether the "link handler" is part of the CRTU-RU or CRTU-PU; in the latter case, it'd mean that the digitalized data would be already available on an external port.

(I'm not sure how the spectrum analyzer fits into this. The CMU200 _does_ appear to have the spectrum analyzer and signal generator ability; not sure why this is commonly mentioned as a difference to the CRTU-RU. It's probably just a power detector on the .. digital board?)

I think this device is promising. Tapping the ADC data, and injecting the DAC data (for example via USB) would be an interesting extension to build; together with a plugin to gnuradio, this should make a wonderful RF frontend for SDR. Only limitation could the bandwidth.

[Wuerstchenhund]

There's little information on the CRTU-RU out there; I can't wait to see a teardown. For the CMU 200, it's a bit better, but I don't know how much of the architecture they share.

As I wrote before, they share almost everything. The CRTU *is* a CMU200 with an additional Windows 2000 controller, a slightly different chassis (CRTU has additional RF ports where the CMU200 has 9pin Sub-Ds and a speaker) and different software. The CRTU also doesn't support all the options that the CMU200 supports (i.e. Audio Analyzer).

Here's the service manual for the CMU200: https://www.ntecusa.com/docs/RS_CMU200_CMU300_other.pdf ; section 3 has a block diagram. If we compare this with the "block diagram" in http://cdn.rohde-schwarz.com/pws/dl_downloads/dl_common_library/dl_news_from_rs/magazin/Neues171_englisch_72dpi.pdf (which also claims that the CRTU-RU uses the same RF components as the CMU200), then we can draw the following conclusions:

• The CRTU-RU is basically a two-channel (2x RX, 2x TX) CMU200.

Not really. Both CRTU and CMU200 can have one or two RF generators, as well as an optional two-channel audio generator. As I said, there's not much difference between them in terms of hardware, aside from some options not being available in the CRTU.

There's also a difference in bandwidth with the second generator, depening on which option is installed.

• But it gets better; on the "digital board", there's an ADC/DAC stage already. Everything further works on this digital data. (There's an optional hook for the I/Q analog data with the option CRTU-B7; it appears that it contains a separate DAC to get the digital I/Q RX back to analog, and just passes through the TX I/Q via a switch.)
• It's a bit unclear whether the "link handler" is part of the CRTU-RU or CRTU-PU; in the latter case, it'd mean that the digitalized data would be already available on an external port.

If I remember right all CRTUs have the digital output at the back, which is meant when they are part of the Protocol Analyzer (a separate large box with a DVD drive on the front).

(I'm not sure how the spectrum analyzer fits into this. The CMU200 _does_ appear to have the spectrum analyzer and signal generator ability; not sure why this is commonly mentioned as a difference to the CRTU-RU. It's probably just a power detector on the .. digital board?)

No, it's not. The spectrum analyzer is a Vector Spectrum Analyzer, i.e. no detector diode but an ADC that digitizes the whole frequency band and gets the individual frequency components via FFT. SA performance is quite good, it's pretty fast, although the sensitivity is pretty low.

And yes, all CMU200 have the Spectrum Analyzer, it's part of the Basic Functionality that comes with every unit. The same is true for the Power Meter btw. The difference to the CRTU is the software, and (if I remember right) the Spectrum Analyzer and Power Meter functionality wasn't available on the CRTU (which would be understandable, since the CRTU was designed as automated test system). But I haven't had that much to do with the CRTU, so I might be wrong on that.

I think this device is promising. Tapping the ADC data, and injecting the DAC data (for example via USB) would be an interesting extension to build; together with a plugin to gnuradio, this should make a wonderful RF frontend for SDR. Only limitation could the bandwidth.

Good luck. I'd say your're severely underestimating how complex these devices really are. For example, I'm pretty sure the ADC data isn't directly available from outside, but only via the proprietary DSPs which in turn connect to the backplane via an old-style 16bit ISA bus. You could of course connect directly to the ADC on the PCB but this will result in the unit failing during initialization (and probably powering down the module). There's also the mechanical component, as you would have to lead wires into the Digital Module which is a completely encapsulated unit with two small openings to provide sufficient airflow. In terms of SDR, the internal controllers in these devices are pretty slow (well, they don't need to be very fast for what they're doing) so that means you would have to use an external PC, for which you would have to design a suitable interface (the available GPIB and serial ports are too slow, and the optional network ports are for feeding IP data into the cell phone transmitter, not for communication with the system's controller). In short, it sounds like a mess and a very good way to produce a nice doorstop. Which would really be a shame.

If you want a RF front end for an SDR go and buy a $7 USB digital TV tuner, or any other of the wide range of suitable devices.[/list]

[mzzj]

And yes, all CMU200 have the Spectrum Analyzer, it's part of the Basic Functionality that comes with every unit. The same is true for the Power Meter btw. The difference to the CRTU is the software, and (if I remember right) the Spectrum Analyzer and Power Meter functionality wasn't available on the CRTU (which would be understandable, since the CRTU was designed as automated test system). But I haven't had that much to do with the CRTU, so I might be wrong on that.

I did some googling around before buying anything and judging by the pictures  it appears that at least some if not every of the CRTU-RU's have spectrum displays.

http://www.ebay.co.uk/itm/R-S-Rohde-Schwarz-Universal-Protocol-Radio-Communication-Analyser-Tester-CRTU-RU-/321539373898 (last pic or so)

[Wuerstchenhund]

I did some googling around before buying anything and judging by the pictures  it appears that at least some if not every of the CRTU-RU's have spectrum displays.

http://www.ebay.co.uk/itm/R-S-Rohde-Schwarz-Universal-Protocol-Radio-Communication-Analyser-Tester-CRTU-RU-/321539373898 (last pic or so)

I guess we'll only find out when people get the CRTUs they bought and (hopefully) report back.

[mjs]

Hi,

I bought quite a few CRTUs with the hope of getting at least a few with IQ options. The current plan is that I should receive a shipment next this week Wednesday/Thursday, so I would like to announce that anybody who is interested will be welcome to participate the teardown. The current plan is next Thursday in Innopoli. Send me a PM with contact information if you'd like to participate!

-- mikko

[Wuerstchenhund]

I bought quite a few CRTUs with the hope of getting at least a few with IQ options.

I doubt there are many CRTUs out there which have the I/Q option (-B7), as these were mostly used as production testers. And if I remember right, the I/Q option for the CRTU is different than the one for the CMU200 (which can often found on ebay).

The current plan is that I should receive a shipment next this week Wednesday/Thursday, so I would like to announce that anybody who is interested will be welcome to participate the teardown. The current plan is next Thursday in Innopoli. Send me a PM with contact information if you'd like to participate!

Just a reminder to those that bought the CRTUs and want to sell some on, I might be interested to buy one from you if the price is right 

[tmbinc]

CRTU-G (GSM) come without -B7, as they use the internal baseband signal processing. CRTU-W (WCDMA aka. UMTS), which use the external CRTU-PU box to do baseband signal processing, should have -B7 installed. (That is my understanding, at least.)

mjs, Finland unfortunately is a bit far away, but I can't wait for pictures.

[mjs]

The batch was received today. I took two pieces to home. The -W (which should have B7 IQ-I/O) has at least dead screen. The -S model does have signal generator and spectrum analyzer. It had some problems with locking the reference, but that might be due to moving from +5 outside to +22°C inside and not waiting or missing 10MHz reference cable. More information will follow.

[mzzj]

The batch was received today. I took two pieces to home. The -W (which should have B7 IQ-I/O) has at least dead screen. The -S model does have signal generator and spectrum analyzer. It had some problems with locking the reference, but that might be due to moving from +5 outside to +22°C inside and not waiting or missing 10MHz reference cable. More information will follow.

Did yours have password login for the win2000?

I tried one of mine and got stuck with the password.
Also had to use external monitor because integrated display was switched off at the end of the boot-up. (worked ok until login screen)

[mzzj]

OK,
-selected dos application in the boot menu and got pretty much 100% CMU200-like GUI with spectrum analyzer and rf-gen functionalities.
-windows applications total mystery, need to get vga cable to connect external monitor and start working with the win2k passwords....
-no luck with B7 IF/IQ option

I bet the machine wont boot from usb drive so probably need to remove the hard drive and reset win2k passwords using another computer (goddammit, need some old clunker with pata drive support...)
And I wonder is there something usefull on the windows side...

[mzzj]

https://dl.dropboxusercontent.com/u/93888484/2015-04-16%2001.48.23.jpg

[mjs]

I did not yet boot to Win2000 and none of the units had a password sticker on them.

The reference locking problem was due to external reference setting and went away after warmup and swithing to internal reference from the menu.

Attached a picture of a 1GHz AM-modulated signal with 5kHz/10Hz span/RBW.

I think the B7 IQ-option can be recognized from the existence of top row IF connectors, as they're wired to the B7 unit and the cables+connectors are part of the option.

[Wuerstchenhund]

I bet the machine wont boot from usb drive

It should. Check the installed options list, at the bottom it should tell you what controller is installed. I think all CRTUs have at least FMR6 controllers (with intel Celeron) and these can boot from USB drive/CDROM if you change the boot sequence in the BIOS.

The Windows2000 partition merely contains the software for automated cell phone testing, and for general purpose is probably rather useless.

[vaizki]

I also obtained a few CRTU-RUs and CMU200s from the auction.

CRTU-RUs when booted to DOS work very similar to CMU200 for basic signal analyzer / rf-gen and power metering as mentioned.

One of my units has a Win2k password, the other doesn't and I can get to the desktop. However it seems like most of the software has been on a shared network drive in the lab... power metering and input assignment utilities work on Win2k side but other than that I couldn't get anything useful out of it without starting to write test cases.

I will definitely see if it can boot linux when I have the time and when I get it running will report on what hardware is seen.

The built-in screen on the unit blacks out when Win2k boots and there is a resolution larger than 640x480 set for the desktop. I was able to just change the resolution to 640x480 and the integrated display popped back on.

My boxes are very low on options unfortunately.. no IQ I/F for me either. 

[Wuerstchenhund]

I also obtained a few CRTU-RUs and CMU200s from the auction.

CRTU-RUs when booted to DOS work very similar to CMU200 for basic signal analyzer / rf-gen and power metering as mentioned.

Did your CRTUs come with one or two RF generators installed?

I will definitely see if it can boot linux when I have the time and when I get it running will report on what hardware is seen.

Linux should run, but it won't be of much use as all functionality sits in proprietary R&S ASICs for which no Linux drivers exist (the PC in these boxes is really just for displaying data). All you'll get is a slow Pentium3 Celeron Linux PC with a tiny display

[vaizki]

Did your CRTUs come with one or two RF generators installed?

I don't have them here but I recall them having only one generator.

Linux should run, but it won't be of much use as all functionality sits in proprietary R&S ASICs for which no Linux drivers exist (the PC in these boxes is really just for displaying data). All you'll get is a slow Pentium3 Celeron Linux PC with a tiny display

Well that's the fun part, mucking about..  do you know how are the ASICs connected to the pc? PCI bus probably?

[Wuerstchenhund]

Well that's the fun part, mucking about..  do you know how are the ASICs connected to the pc? PCI bus probably?

No PCI, it's 16bit ISA.

R&S used ISA in pretty much all their PC controlled instruments until a few years ago.

[new299]

I picked one of these up. It appears to have Spectrum analyzer functionality from 10MHz (see attached). I've not had much of a chance to play with it yet but will report back when I do...

[Howardlong]

What is the maximum span of the SA? I'm not familiar with these particular units, but some analysers designed primarily for cellular only have limited span on their SAs, perhaps a few MHz, allowing good narrow band analysis, but of limited practical use if you're after a wider analysis such as looking for spurii, harmonics or mixing products.

[mzzj]

What is the maximum span of the SA? I'm not familiar with these particular units, but some analysers designed primarily for cellular only have limited span on their SAs, perhaps a few MHz, allowing good narrow band analysis, but of limited practical use if you're after a wider analysis such as looking for spurii, harmonics or mixing products.

10-2700Mhz

[new299]

I can't see any limit on the span.

[Wuerstchenhund]

What is the maximum span of the SA? I'm not familiar with these particular units, but some analysers designed primarily for cellular only have limited span on their SAs, perhaps a few MHz, allowing good narrow band analysis, but of limited practical use if you're after a wider analysis such as looking for spurii, harmonics or mixing products.

Not these units, the CMU200 (and the CRTU apparently) support a span from 0 to full bandwidth (2.69GHz) and RBW from 10Hz to 1MHz in 1-2-3-5 stepping. Since they are VSAs there's no VBW setting.

The SA part in these units is actually quite good (especially when compared with many other wireless testers), not high end lab grade standalone SA good (and the noise level is quite high) but more than good enough for a lot of simple RF work or for getting a first start in RF.

[KJDS]

I had a brief play with the CMU200 spec ana last night. Works ok and from the brief test I did with it then I'd guess it is somewhere between an Agilent 8594 and an 8564.