Symmetricom Timesource 2700 CDMA reference clock teardown - Page 1
Forum section: electronics / testgear

author: D Straney
author_rank: Frequent Contributor
timestamp: July 29, 2019, 02:18:09 am
content: Here's an interesting piece of equipment that came through one of those "friend-of-a-friend-of-a-friend saw it being thrown out and thought it might be useful" channels. Most of it's probably going to electronics recycling but there's some RF stuff to scavenge here, and it's good for a bit of reverse-engineering.Anyways Symmetricom, before they apparently ended up bought by Microchip, made/makes time synchronization equipment, both atomic clocks and also receivers which provide networked time standards. This one appears to connect to a CDMA cell network and use that (not too familiar with CDMA but it must provide an accurate broadcast time?) to provide a 10 Mhz reference (the most useful output to the types here!), network time maybe on some Ethernet ports, and "TOD" (time of day, probably) on RS-422 (!).Not sure what equipment would expect an RS-422 input with time-of-day, but there's got to be some old standard there I'm not familiar with.Here's the inside:There's a stack of 3 boards, with a "PCS Receiver" RF board on top, a "CDMA DSP" board in the middle, and a main board on the bottom.The SMA connector on the RF board is labeled "CDMA In" on the back, which confirms that's the antenna input. Let's follow the signal chain:It's basically a 2-stage downconverter, with references provided by a dual frequency synthesizer. The second mixer (the RF2667) has I and Q outputs, but the I output doesn't get used; it's just used as an AGC+downconverter instead of AGC+demodulator. We'll get to that in a bit...PCS works in the 1850-1990 Mhz band, and the first VCO has a 2132-2204 Mhz tuning range, which means the first IF is anywhere from 214-282 Mhz. The second VCO has a tuning range of 400-475 Mhz, which means that the second IF is somewhere from 118-261 Mhz. I labeled the CLC5612 amps (which drive the signal over the connector down to the DSP board) as 90 Mhz but that's really just for a gain of +2; at a gain of +1 they've got the -3 dB (after some peaking) out at over 100 Mhz, which makes me suspect that the second IF is on the lower end and these amps are being pushed near their useful bandwidth limit. Maybe there's enough gain in the rest of the signal chain that they're not worried about losing a few dB on the rolloff of these. This RF board looks useful for some repurposing, if I swap out some combo of VCOs and filters depending on the frequency band...So where does the second IF signal go on the DSP board?No analog demodulator here! There's a crystal oscillator at the top-left (24.4756 Mhz according to the etching) which is fed through a Minicircuits transformer and up to the RF board to serve as the frequency synthesizer's reference. The second IF signal from the RF board, though, goes straight through some passive filters into an HI5805 12-bit 5MSPS (but 100 Mhz analog BW) ADC, which feeds into a nice big Xilinx FPGA. From what I can find, CDMA uses QPSK, like you'd expect from any vaguely modern comms system, so it's not just getting by on sensing amplitude variations alone - this is very likely some old-school software-defined radio action here. It's possible that it's locking the sampling frequency to a fraction of the IF frequency so that it can pull out the phase from the amplitude right at the sampling time, but from even the little I know about this sort of thing that feels very risky noise-wise; seems more likely it's just under-sampling the IF signal and then demodulating it digitally in the FPGA with maybe some other packet-framing stuff or something. There's also a Motorola processor to the right of the FPGA, with memories around it.Finally here's the main board:Lots more going on here. There's a half-bridge power supply to the left, with redundant power inputs diode-OR'ed together:Most of the rest is digital though, and probably related to protocol decoding and the networking bits. You can see some pulse transformers feeding the Ethernet jacks.There's also a digital ASIC, from the days when getting a standard gate array with a custom metal mask was more common. Also has a Zilog serial comms controller next to it, and a Motorola processor to the left:However, the main board also has some mystery bits where I'm honestly not sure what's going on. Notice the large blocked-off area with a connector in the top-right which looks like it's meant for a module to plug in: some kind of subscriber interface thing? There's also this Actel programmable logic and a 125 Mhz DDS chip (the AD9850):What's it doing with that generated sinewave? Unfortunately I've got no idea. The DDS output goes through some passive filters into that Minicircuits module, which is a mixer. After that I lost the trail though, even with a bunch of probing around; it didn't help that the mixer module either has a different pinout than the one in the current Minicircuits datasheet, or it's being used in some unconventional way like they're familiar with the internals. The rest of the circuitry around there is comparatively very low-speed stuff (a TL431 reference, some LM358 op-amps). There are a couple AD811 high-speed (>150 Mhz) amplifiers and an unconnected RF connector nearby too though. It's possible that it's capable of generating a time-sync signal to send to an RFPA and antenna to broadcast locally?Let's check out the 10 Mhz signal generation. That's done in the bottom-right section, which seems to be linked to the low-speed op-amps which also seem to be linked to the mixer:The gray module at the top is a 60 Mhz probably-ovenized crystal oscillator; it feeds the clock input of a quad D-FF chip nearby which has an interesting 3-series-D-FF loop to do a divide-by-6, and produce a 10 Mhz signal. This 10 Mhz is fed through...* An XOR gate used as a buffer (I couldn't find what the other XOR gates in the package connected to, so it may be just here for buffering which is bizarre...)* A multi-stage low-pass filter (see the L and C chain of L18, L19, etc.)* A MiniCircuits transformer, which brings the signal into the right-most section in the photo, and produces a differential output* A pair of high-speed high-output-current CFB op-amps, fed by +/- 5V regulators on either side, which boost the signal by 2x and then drive it through 25-ohm series resistors into...* ...finally, the last transformer, which directly drives the 10 Mhz BNC output.The reason this is better than just an ovenized crystal oscillator tacked onto an existing product though is that the OCXO has what looks like a "frequency trim" pin, and this is driven by something in the low-speed analog mess near it. So what I think it's doing is using the OCXO for a low-jitter frequency source, but then using some sort of digital feedback loop to adjust its frequency to the CDMA reference and stabilize the longer-term drift....like a GPS-disciplined oscillator, I guess, but with CDMA instead.Hope you enjoyed the look inside this almost-20-year-old frequency reference. I still can't quite get over that it was somehow worth doing SDR in 2001 for this...

author: little.tesla
author_rank: Regular Contributor
timestamp: December 01, 2019, 03:00:43 pm
content: There is a teardown of a TS2500 in this thread:https://www.eevblog.com/forum/testgear/symmetricom-timesource-2500-2700-software/Which is almost identical to the TS2700.