Author Topic: Avionics reverse-engineering: spacecraft equipment  (Read 2514 times)

0 Members and 4 Guests are viewing this topic.

Offline D StraneyTopic starter

  • Regular Contributor
  • *
  • Posts: 230
  • Country: us
Avionics reverse-engineering: spacecraft equipment
« on: June 30, 2024, 11:01:56 pm »
The last couple years I've been keeping an eye out for interesting electronics to take apart in gold-scrap auctions or from industrial surplus sellers.  I've been lucky enough to find some space electronics, and thought other people might be interesting in seeing these too.

Index:

Hughes mystery RF box

The seller listed this as coming from Hughes Aircraft, which means it was likely from their Space & Communications Group, which is now Boeing.  From this and other sources (a 1992 promotional photo showing the Hughes Space & Comms group's spacecraft), their main business seemed to be communications satellites.

So, we can expect this to be most likely communications-related.  This particular module has a couple DE-15 connectors for power & control, and generates an RF output of some kind, as well as having another coax that according to the "T.P." label serves as an internal testpoint(??):


DC control/power half
After removing many screws and taking off the top lid, you can see the low-frequency half:


The outer section contains relays, diodes, and filtering components, which probably switch & filter bias power to the RF section, via the many feed-throughs visible in holes in the board.
The inner section contains an op-amp (DIP package, JM38510/13503 = OP27A) and possibly a second op-amp (metal can labeled "OP37034J", might be an OP37 according to one obscure reference).  This inner section, judging from the feed-through connections, appears to provide the final amplification and/or complementary bipolar drive voltages for biasing a varactor in the RF portion (we'll get to that in a bit).


You can see the thick layer of conformal coating, and the very nicely-bundled-and-epoxied wires:


RF half
The other lid, with even more screws for all the separate compartments, holds a wonderful variety of microwave magic:

There's a lot of additional internal shields, but after removing those, the circuitry becomes more clear:


Starting in the top-right corner...
1. Oscillator #1 & amplification, filtering

The metal can seems to be an oscillator: it's labeled "122.542338 Mhz".  This drives a series of amplifier stages, in the form of RF transistors in interesting glass-lid packages.  It's possible, depending on the biasing, that some of these are being driven into saturation to create harmonics for frequency multiplication, but I have no way of knowing.

A filter follows, which has an interesting combination of distributed elements (the rectangular traces) and lumped elements (the spring-looking inductors):

A couple more amplifier stages follow the filter:


2. SRD comb generator & filtering
After this, some frequency multiplication almost definitely happens: the signal goes through a lumped pi filter, to a diode connected in a shunt configuration to ground.  See the middle of this photo:

This is probably a Step Recovery Diode (SRD) or something similar.  SRDs have a reverse-recovery current when reverse-biased which stops very suddenly; if you excite it correctly with an AC current you can create a train of very short pulses, which due to their sharpness contain many harmonics of the input frequency.  For frequency multiplication, you can then apply a bandpass filter to pick out the specific harmonic that you want, while suppressing the others.  In this case, you can see the non-uniform parallel-coupled lines filter directly following the SRD.
I don't know the dielectric constant of the ceramic substrate, but the length of the filter sections (~3 mm for 1/2 wavelength) suggests somewhere in the 20-40 Ghz range.

Oscillator #2 & amplification
Let's back up a bit now before shit gets weird, and look at the cavity at the top-center: this holds an oscillator tuned by a dielectric resonator, or a DRO (Dielectric Resonator Oscillator).  This type of oscillator is common in satellite dish up/downconverters, and uses a high-permittivity ceramic material as an E-field resonant cavity due to the cylindrical resonant modes it can support.  The resonant frequencies depend only on the geometry of the resonator & its permittivity: go here and click on "Read More" on the first article (https://doi.org/10.1016/j.pnmrs.2014.09.003 by Andrew Webb) for an explanation of resonant cavities.  There's also some pretty good diagrams from that article here and here which help visualize what's going on.

In our case, that yellow disc is the dielectric resonator, the trace running next to it loosely couples the signal to and from the resonator, and the gold part to the left of it is the transistor that adds amplification to turn it into an oscillator.  I assume that the transistor's reverse-transfer(/Miller) capacitance is what adds the feedback needed to create the oscillation.

Also coupled to the resonator (better visible in photo below) is a separate trace with a white varactor, which is used to slightly detune the resonator, and therefore adjust the tuning of the oscillator:

You can see that the anode and the cathode of the varactor both go to semicircular RF-blocks, and then to feedthroughs: the op-amp(s) in the DC half seem to drive the voltage across this varactor, to set the fine-tuning control of oscillator #2.

Splitting & mixing
The oscillator #2 output signal goes through a couple stages of amplification, and then enters a branchline coupler which splits the signal along two paths.


One path goes to the output coax connector, through a chain of amplifiers (along the left side in photo):


The other path goes through a circulator to a mystery module.  This mystery module gets its other input from the filtered SRD-multiplied reference frequency from oscillator #1:

Unscrewing and flipping over the mystery module reveals it's made by Watkins-Johnson:

It has a 3rd connection, which goes straight through a feedthrough to the DC side above, where it connects to the board with the op-amps.

What's actually happening here?
The only thing that makes sense to me, with this set of connections, is this:
Oscillator #1 is a stable reference frequency source (generating 20-40 Ghz via the SRD), while oscillator #2 is an inaccurate but tunable oscillator, which is also used as the output of this whole box.  The mystery Watkins-Johnson module is a mixer, which is used to compare the two oscillator outputs.  The op-amps in the control section here adjust the DC tuning voltage on oscillator #2's varactor until the two oscillators match frequency - this keeps oscillator #2 (and therefore the final RF output) frequency-stable in the long-term.  However, the varactor-driver op-amp also sums the feedback control with an external modulation signal from one of the DE-15 connectors, which allows short-term changes to the tuning to produce frequency and/or phase modulation on the final RF output.  Something like this would normally be used as the RF signal source for a transmitter.

There's other ways to produce a stable-but-modulated frequency for communications: you can...
  • split your frequency reference into I and Q signals (in-phase, and 90-degrees shifted), amplitude-modulate each one separately, and then re-combine to produce phase and amplitude modulation
  • mix directly with your frequency-modulation signal, if you have a double-balanced mixer to suppress the LO in your output
  • do multi-stage upconversion like the "exciter" from a SINCGARS military radio I looked at before: this is similar to the previous item
  • etc.
However, the I/Q scheme doesn't allow for frequency modulation, and working in the 10s-of-Ghz range severely limits your options for active devices; you'll have a very hard time implementing a good balanced mixer (especially considering the 1994 date code on one of the op-amps), so I can see why you'd go for this dual-locked-oscillators scheme.

Hope this was interesting, let me know if you've got any info or insights I missed.
« Last Edit: July 19, 2024, 03:31:07 am by D Straney »
 

Offline D StraneyTopic starter

  • Regular Contributor
  • *
  • Posts: 230
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #1 on: July 01, 2024, 09:44:44 pm »
Meant to mention, the external "T.P." coax connector is connected to the filtered, amplified, pre-SRD output of oscillator #1 (the metal-can frequency reference).

Also here's a better photo of the SRD: you can see the package standing on end, with one terminal attached to the case (ground) and the other terminal with "pass-through" foil bonds to the circuit sections before and after it.  There's a small gap just to the left of the SRD, on the output side.  This acts as a very small-value capacitor, which serves as a high-pass filter to block all the unwanted low frequencies (such as the input frequency) that come out of the frequency multiplication.
« Last Edit: July 01, 2024, 09:46:22 pm by D Straney »
 
The following users thanked this post: doktor pyta

Offline electr_peter

  • Supporter
  • ****
  • Posts: 1343
  • Country: lt
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #2 on: July 04, 2024, 10:37:12 pm »
Great post with technical explanations. I hope your hands did not become tired after dealing with so many screws. By the way, were screws lock-tited (beside dab of gray glue on side)?

Do I understand correctly that this metal box with cavities is milled from single block? Are RF ceramic assemblies and DC biasing circuits bolted to the same central metal plate, just from 2 sides? Probably provides heatsinking function as well.

Implementation of dielectric resonator looks very interesting, yet simple at first glance. Small hole is visible on top resonator surface, was it originally there?
There is so much effort in interference suppression (multiple circulators, RF absorbers, metal cans in metal cans, etc.). I wonder how long it takes to assemble and adjust as there are so many adjusting gold strips added.

Those glass transistor packages are pre-tested wire-bonded and encapsulated bare die transistors/amplifiers. I guess they could be added to big ceramic plates directly without glass encapsulation, but wire-bonds and extra small components were deemed too unreliable at this scale. There are no wire bonds visible on big ceramic plates, only goldstrips. Can you do a close-up photo of glass encapsulated transistors?
 

Offline coppice

  • Super Contributor
  • ***
  • Posts: 8946
  • Country: gb
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #3 on: July 04, 2024, 10:43:36 pm »
Are those boards definitely ceramic? They kinda look like teflon.
 

Offline D StraneyTopic starter

  • Regular Contributor
  • *
  • Posts: 230
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #4 on: July 05, 2024, 12:19:53 am »
Thanks!  Yes, removing the screws from the top and bottom was absolutely an exercise in patience.

Screw locking: I think it was mostly just the dab of glue on the side for external and internal screws.
Enclosure construction: That's right, I'm about 99% sure it's made from one single solid block, with the middle plate used for mounting from both sides as you describe.  Kind of a subtle addition to the "no expense spared" vibes of the gold and the many specialty substrates, to take a big (potentially-special-alloy) metal block and mill away most of it.
Dielectric resonator: I'm not sure about the chip on the corner of the resonator; I vaguely remember (this was sometime last year) having to put in extra effort to remove that particular lid, so it's possible that in the process of levering up the lid with one of my beater "mini-crowbar / too-worn-for-normal-use" screwdrivers that I hit the resonator.  (Wouldn't be the first time)  I do wonder how much that would affect the resonance though, and whether it's well within the tuning range of the varactor or not (might affect the Q more than the frequency?)
Gold adjustment strips: Yes, good eye!  I'd meant to call attention to those too, they definitely stood out looking up-close in person; can only imagine some poor technician spending a week per box staring at a VNA while repeatedly bonding bits of foil.
PCB material: I see what you're getting at, with the color, it sure does look like Teflon in the photos.  In person though it's very hard (under tweezers) and shiny.
Transistors & bonding: Yeah I was curious about those bonded foil strips between components & board sections: I guess wirebonding-style thermal/ultrasonic methods get used for the same size ballpark when assembling large-die power modules, so it could be the same.  Getting an up-close view of the transistors is a good idea - my normal camera doesn't get in that far, but I regularly visit the "open electronics night" at my local makerspace for their high-zoom microscope, and was just wondering what to put under it next time...
 
The following users thanked this post: SeanB

Offline coppice

  • Super Contributor
  • ***
  • Posts: 8946
  • Country: gb
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #5 on: July 05, 2024, 10:34:24 am »
PCB material: I see what you're getting at, with the color, it sure does look like Teflon in the photos.  In person though it's very hard (under tweezers) and shiny.
It was the shininess that made me think it was teflon. Technical ceramics usually give falrly diffuse reflections. A lot of defence RF stuff uses pure teflon PCBs for its high frequency performance. They are a PITA, as teflon flows so well. It need lots of support to keep it dimensionally stable over time, especially in things like missiles, where vibration is so intense it can liquefy all sorts of things. I think dealing with liquefaction is probably the key skill that makes someone a rocket scientist.
 

Offline electr_peter

  • Supporter
  • ****
  • Posts: 1343
  • Country: lt
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #6 on: July 05, 2024, 02:49:09 pm »
Enclosure construction: That's right, I'm about 99% sure it's made from one single solid block, with the middle plate used for mounting from both sides as you describe.  Kind of a subtle addition to the "no expense spared" vibes of the gold and the many specialty substrates, to take a big (potentially-special-alloy) metal block and mill away most of it.
HDD cases are roughly similar to this RF box - cases are cast first, then last few % milled. That saves few $ when done in volumes. Here we see "no expenses spared" solution aimed at ultra high performance and reliability, thus milling straight from the block.

Note that case surfaces are coated with conductive yellow metal (gold solution?) and most walls/surfaces have RF absorbers.
« Last Edit: July 05, 2024, 07:25:45 pm by electr_peter »
 

Online Haenk

  • Super Contributor
  • ***
  • Posts: 1166
  • Country: de
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #7 on: July 05, 2024, 07:03:16 pm »
I`d say this is machined from a block and not cast. Setting up casting is quite a process, makes sense If you want to produce millions of units. For a one-of-one item, machining is way cheaper and faster. Still expensive... Plus you might be able to use better suited materials.
 

Offline electr_peter

  • Supporter
  • ****
  • Posts: 1343
  • Country: lt
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #8 on: July 05, 2024, 07:25:17 pm »
I meant that this RF box is milled from one block and not cast. HDD cases are cast, then processed.
 

Offline coppice

  • Super Contributor
  • ***
  • Posts: 8946
  • Country: gb
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #9 on: July 05, 2024, 07:41:04 pm »
I meant that this RF box is milled from one block and not cast. HDD cases are cast, then processed.
Military grade RF boxes are normally milled from a block. That was a PITA 50 years ago, but CNC has made is easy, if still not exactly cheap. Casting leaves too many voids for their purposes, and doesn't offer the same strength.
 

Offline glenenglish

  • Frequent Contributor
  • **
  • Posts: 352
  • Country: au
  • RF engineer. AI6UM / VK1XX . Aviation pilot. MTBr
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #10 on: July 05, 2024, 07:56:01 pm »
great post, really enjoyed it
 

Offline D StraneyTopic starter

  • Regular Contributor
  • *
  • Posts: 230
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #11 on: July 06, 2024, 12:43:43 am »
It was the shininess that made me think it was teflon. Technical ceramics usually give falrly diffuse reflections. A lot of defence RF stuff uses pure teflon PCBs for its high frequency performance. They are a PITA, as teflon flows so well. It need lots of support to keep it dimensionally stable over time, especially in things like missiles, where vibration is so intense it can liquefy all sorts of things. I think dealing with liquefaction is probably the key skill that makes someone a rocket scientist.
Huh that's interesting, makes sense that the creep would start causing all sorts of problems with tuning.  The teflon I've seen has been either raw stock for machining (where it's got a pretty dull surface) or the Rogers-type microwave substrates where there's other stuff in there too to explain the color/texture, wouldn't have expected it to be shiny.

Offline calzap

  • Frequent Contributor
  • **
  • Posts: 480
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #12 on: July 06, 2024, 04:47:37 pm »
Interesting post.  Thanks for the explanations.  I would have guessed microwave RF and that’s as far as I would have gone.  Did you weigh the unit?  With the metal case, looks hefty.  Do you think an identical device could have been part of a satellite or more likely a ground-based or airplane RF unit?

Mike
« Last Edit: July 07, 2024, 12:11:35 am by calzap »
 

Offline D StraneyTopic starter

  • Regular Contributor
  • *
  • Posts: 230
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #13 on: July 06, 2024, 10:25:23 pm »
Glad you liked it - I haven't weighed the box and I'm terrible at guessing weights, but it is pretty heavy for its size, with a lot of solid metal!  Ground equipment for space installations is usually rack-mount stuff that looks much more "normal", as it doesn't have to put up with unusual environmental conditions; everything about the packaging on this one, based on lots of photos of other space hardware, says "I'm made for spaceflight".  Can't be 100% sure of course, but my best guess is that other copies of this are on a communications satellite somewhere (or that this was a prototype for a design which ended up on a satellite).

Ok, here's #2.
Space Micro microwave transmitter
These few boards came in a set (for gold scrap), and all appear from the labeling to come from the same unit: a "µXTx"-model X-band (~8-12 Ghz) microwave transmitter, which takes in a digital data stream and outputs modulated & amplified RF directly to an antenna.  Here's a datasheet for a very similar model, except these boards date from about 2008-2011.  The manufacturer is Space Micro, a commercial supplier of electronics & optics for satellites.  These are not COTS parts meant for low-cost cubesats where the lifetimes are measured in weeks or months though; the Space Micro products seem to be mostly radiation-hardened high-reliability stuff meant to work for a decade+ (that translates to more-interesting parts for us to look at!).

Digital Board

To see where the data starts its journey, let's look at the digital board first.  The digital data stream most likely enters from outside the box into the connector at the bottom-left.  This looks a lot like a specific connector series made by Samtec that I've used before, which has impedance-controlled contact geometry and keeps a ground plane present at all times, with a flat plate on the male side and a bunch of mating contacts on the female side - this is designed specifically for, and works great for, carrying high-speed digital signals.  Here's a link to the Samtec Q-strip series, where you can see some images of what I'm talking about.

This data makes its way to the Actel ProASIC3E FPGA that does almost all the digital processing on this board:

There's also a mystery ASIC to help it out - the "LDPC" in the name might stand for "Low-Density Parity Check" coding.  I don't understand exactly how they work, but they seem to find a lot of use in communications, which supports the idea of this ASIC being a hardware accelerator.  You can also read an article here on its implementation in an ASIC for multi-Gbps data, which again seems pretty applicable here.

The FPGA also has access to a 128K x 8 EEPROM (5962-3826716).  I'm not sure exactly what this is storing; can't imagine it's the FPGA configuration but I don't see a dedicated EEPROM for that, or it could also be program code for a soft processor used in the FPGA.


This system is an SDR (Software-Defined Radio): the modulation is all done digitally on the FPGA, which then drives a DAC to produce the modulated IF signal.  Flexibility is very important in space applications (as you can't just pop the cover and swap a board once it's in orbit...if you're not a high-priority space telescope, that is) and the datasheet for the uXTx transmitter mentions many aspects that are configurable in the field, such as modulation scheme - this is how that's done.

The DAC itself is a Texas Instruments DAC5675A, which does an impressive 14 bits @ 400 Msps.  This is fast enough, if run at full speed, to produce a modulated IF output in the 10-100 Mhz frequency range.
You can also see an interesting pattern here, which is repeated throughout these boards: notice that the footprint on the board is meant for the much wider ceramic & gold package, of the rad-hard space-grade part you can view here.  But they've used a little daughterboard which adapts the this footprint to the infinitely-cheaper commercial plastic-packaged version of the DAC5675A - this strongly suggests that these boards were an early-stage prototype/bench-evaluation copy, definitely not a model meant for environmental testing or flight.  When you might blow up some chips and just want to test the basic design functionality in a climate-controlled lab, why waste thousands of dollars per IC?

The DAC gets its clock from the modulator board (we'll look at that next), which provides a reference clock so that all the clock sources are synchronized.  This clock enters through one of the two coax connectors, gets converted to LVDS by a DS90LV031A, and sent directly to the DAC.  A second copy of the incoming clock is also converted to LVDS and sent to the FPGA, but first it goes through the winding delay line at the left here.  You can see the multiple groups of three resistor footprints: at each one, the path can be tuned to be slightly longer or shorter (therefore tuning the delay time) by choosing whether the two "longer-path" or the one "shorter bypass path" resistor is populated.

The FPGA can't change change the output data to the DAC right at the DAC's clock edge(s): it needs to change the data somewhere in the middle of the clock cycle, to meet setup and hold time requirements.  I believe that timing constraint is being enforced here by this hard-wired delay, to provide the FPGA with a clock that can be used to synchronize the output data to the DAC.

I did a similar thing about 12 years ago, but with an ADC sending a few lanes of DDR serial data to a Spartan 6 FPGA.  The reference implementation there from TI/Xilinx used a tunable delay element built into the FPGA's I/O block, which was automatically tuned at startup by setting a test pattern, finding the delay values that would align the data with both clock edges, and then setting a final delay value halfway in between those two for maximum headroom.  That's much harder to pull off with outgoing rather than incoming data, though, plus I don't know if this rad-hard FPGA even has a tuneable delay; it also adds extra complexity and room for things to go wrong, if the desired clock delay is a known quantity and can be determined ahead of time.

Anyways, the DAC's output now drives a coax output via a transformer that does the differential-to-single-ended conversion (top-right in the photo below).  You can also see the linear regulator (MSK 5900RH) which likely provides a low-noise supply for the DAC.
Digital board by D Straney, on Flickr

Finally, there's an LM139 quad comparator.  I don't know what this does: maybe it monitors RFPA temperature for the FPGA? (We'll see that later)  From the connections, and lack of resistors on the bottom side of the board below the comparator, it looks like only one of the comparators is actually used.


Modulator Board
This board generates the reference clock for the digital board, and up-converts the digitally-generated IF signal to the X-band output frequency.

It's a sign of how far miniaturization has come, that most of the complex RF functionality (VCOs, mixers, etc.) is stuffed into a few MMICs in a row along the bottom...


...while the largest component by far is just a passive quadrature coupler, which splits a signal into in-phase and 90-degree-shifted components:

I really have no idea why this particular part is used; the MITEQ catalog lists it as supporting 50 - 110 Mhz @ 250W average, but it never sees even anywhere near a single watt on this board.  With such a low frequency range I can't imagine the coupler uses distributed elements within, which would make it physically large no matter the power level...but it's also very flat, so who knows.

Anyways, things begin at an empty footprint, which I'm 99% sure used to hold a reference oscillator module like the one from the Rocketdyne CPU board:



The chip in charge of generating the LO signal for upconversion is this Peregrine PE9763, which contains all the functionality of a frequency synthesizer, minus the VCO itself:

Its parallel control inputs probably get set by the FPGA.

If you look at how everything connects, it all makes sense:

The PE9673 frequency synthesizer maxes out at 3.2 Ghz, but the design here takes advantage of the fact that the VCO has a "divided-by-2" output to synthesize a higher LO frequency.  It still doesn't entirely make sense, as the VCO (Hittite/Analog Devices HMC510) has an ~8.5-9.5 Ghz range, which is still >3.2 Ghz when divided by 2.  Maybe I missed something when tracing the connections.  Either way, the DAC gets a divided-by-16 copy of the VCO as its clock.  The upconverted RF output goes out to the power amplifier on a different coax connector.

The long metal-boxed filter down the side of the board seems to be anti-aliasing for the DAC.  The input would be at the port marked "output" on the filter, but as it's a passive device with the same impedance at input and output ports, the input and output are going to be interchangeable anyways - the actual filter schematic inside is almost definitely perfectly symmetric.

The one uncertain part is the mystery device with a custom-looking part number here, which I haven't been able to find any references to.  It has DC biasing resistors connected to all the RF signals that go through it, and given its place in the circuit, the only thing that makes sense in context is if it's a dual amplifier (see schematic above).

I have no idea why it would be necessary to make a custom package with two RF amplifiers here, as this doesn't seem like a particularly unusual need, or space-constrained in any way.  Let me know if you've got better ideas.  Maybe I'll pop the lid on this device and have a look inside to confirm.

RF Power Amplifier
The final board in the signal chain here is the power amplifier, which boosts the modulated RF to a few watts for transmission through the external antenna.

You can see that it's meant to dissipate some real power, as the base plate is a solid metal block, which the power transistors are connected to directly.

Things start at the input connector, where the modulated RF signal goes through a couple stages of preliminary amplification (HMC346 & HMC441 amplifiers)...

...before driving the first dedicated power transistor:

The output stage consists of two paralleled transistors sharing the output power: the signal gets split in half through a branchline coupler, fed to the two larger power transistors, and then re-combined through another branchline coupler.

Other features of the output stage, visible in this photo:
  • A directional coupler (the upside-down "U" at the left) picks off a small portion of the output signal.  The forward-power signal from the coupler goes through a resistive attenuator, and then into a mystery part (large gold box at bottom-left).  This mystery box also connects (from its right side) to one of the discrete-wire connections that bring DC power to the RFPA.  Because the connections to this second signal are not set up at all for high frequencies, it must be DC of some kind - my best guess is that the "mystery part" is a power detector, used to monitor the output power level.
  • A circulator (silver box at left, likely with resistive termination inside) to keep out reflected power from the filter (discussed next) & antenna.
  • Output filtering, just before the coax connector (top-left corner): the standout feature here is all the little semicircular wideband quarter-wave stubs.  These are normally used as an RF short at their quarter-wavelength frequency to block RF on DC control traces - you can see the ones used for this purpose at the bottom-right & top-right of the photo, on the DC bias lines for the power transistors.  However, here, their in-line placement with the RF signal, and the small size compared to the branchline coupler, makes me think they're supposed to suppress a specific harmonic frequency in the output.  They look roughly 1/3 to 1/4 the size of the DC bias ones at the bottom right, so they're probably supposed to block the 3rd or 4th harmonic of the output frequency.  The branchline couplers are much larger, but the lines in these don't have to be 1/4 wavelength: they can be made any odd multiple of 1/4 wavelength, whatever makes the layout easiest (with some bandwidth penalties I think).

A temperature sensor lives next to one of the output-stage transistors, to monitor their temperature.  I'm not sure exactly where on the other boards this is monitored.


One thing I didn't have any luck with, was finding out how the power transistor biasing was done.  Most of the time you can't just put a constant DC voltage or current on the gate or base, as the threshold voltage or beta will change wildly with temperature and send the DC operating point into all kinds of undesirable (too-low & too-high) regions.  The input bias connections on this board just went straight through filters to off-board wires, and none of the other boards had circuitry that could be doing collector-current-based bias control or anything similar.  Then again, a lot of these types of amplifiers I think are full-on ICs these days, rather than just a plain transistor, and so could easily have their own bias-control circuitry on-chip (this is not my field at all so please correct me if I'm wrong).

Power Board
The last board here is the under-appreciated power supply, which creates all the low supply voltages (+10V, +/- 5V, +3.3V, +2.5V, +1.5V)  for the other boards, generated from an external 28VDC input bus.


Most of this board is off-the-shelf DC-DC converter and EMI filter modules; we can look inside those later.

There's also some linear regulators, which create the lower voltages:


Here's what's going on circuitry-wise on this board, with details omitted where they don't add anything:


The interesting bits on this board are...

1. At the output of the +10V supply: really a +/-5V supply, with the -5V referred to ground.  I'm guessing the +10V is used for the RFPA.

These components are in the "input power present indication" box on the schematic.  A TL431 and optocoupler produce a 2.5V digital output which is high when the input power is above a certain voltage threshold: this is probably sent to the FPGA, and used to tell when the input voltage is starting to sag for some reason.

2. Behind the linear regulators:

The two ICs here are a quad op-amp, and a quad AND gate.  An op-amp and two AND gates are used, as described on the schematic, to wait for the +3.3V supply to be present and also a "high" control signal from the FPGA, to activate the +10V supply.  This further supports the idea that the +10V supply powers the RFPA.

The other 3 op-amps are used in an interesting way: each subtracts one voltage rail from another, and the results travel off-board via a set of discrete wires.  My best guess here is that these wires go to an external connector on the box, and are used during testing.  During environmental testing of a piece of space equipment, you'd want to be able to make sure that all the internal power supplies are working correctly even when the box is being baked or shaken, and so monitoring the internal supply voltages would be important.  Looking at linear combinations of the supply voltages lets you verify this with fewer wires, though, than if you just ran every internal supply voltage to the connector: the (+2.5V) - (+1.5V) output, for example, (TP27) will always read about +1V if both supplies are working correctly.  If the measurement is significantly different than +1V, it doesn't tell you whether the 2.5V or the 1.5V supply is failing, but you know that something is wrong.

With the SOIC packages above, you can see the same type of "dual prototyping & flight" component footprints that I mentioned before with the DAC, on the digital board.  Notice how there are standard plastic SOICs populated, the same as I'd buy from Digi-Key - but the pads extend much further, with a little bit of soldermask dividing the two sections of each pad.  This is likely so that rad-hard flight-qualified ceramic flatpack versions of these same ICs, which are much larger, can be populated on non-prototype versions of the boards.  If you go back and look at the two optoisolators on the power board, you can see a similar thing: next to each plastic optoisolator is an unused slightly strange-shaped footprint, meant for a space-grade optoisolator in a package like this one.


Anyways, that was a whole lot of text - hope that was an interesting look inside some real satellite hardware.
« Last Edit: July 06, 2024, 10:32:05 pm by D Straney »
 
The following users thanked this post: SeanB, PA0PBZ, calzap, daqq, ch_scr

Offline D StraneyTopic starter

  • Regular Contributor
  • *
  • Posts: 230
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #14 on: July 07, 2024, 01:39:12 am »
A few extra things about the Space Micro boards:

Coax connectors: There were some extra little spring-loaded adapters on the Modulator board coax connectors, that had a lot of "play"; I don't know if this is the equivalent of a helical shaft coupling but for coax, to keep vibration and shock from being transmitted to the soldered connector?  I can imagine on a launch vehicle, even a short length of well-secured cable could pick up a good deal of inertia.


Power amp input stages: First IC in the RF PA, the HMC346, is actually a controllable attenuator.  This is probably used to set the transmit power.

Missing board: I feel like there's probably a missing board, because the RF PA leaves a lot of loose ends.  Besides the biasing circuitry I mentioned earlier which it may or may not need, with all the "introspection" & engineering telemetry normally done on spacecraft equipment I'd expect there to be current-draw measurements for the RF PA's power power supply.  There's also no low-speed ADC for measuring things like the temperature sensor on the RF PA, or the output of the possible-power-detector in its output stage.  It's possible that the temperature sensor is a (solid-state) switch with an "ok vs. too hot" threshold output, and that the power detector output connects to the comparator on the digital board to give a simple "power vs. no power" indication...but it seems less likely.  There's also no low-speed analog output to set the HMC346 attenuator on the RF PA.

DC-DC and EMI filter modules: Let's look inside those modules on the power board...


The EMI filters are straightforward: each one has, in order...
  • A common-mode choke
  • Capacitance
  • A strictly-differential-mode series inductor
  • More capacitance
  • Capacitance with a series resistor, to damp the resonance with the series inductor
  • Capacitance from each output to the metal enclosure



There's a large DC-DC (which generates the +10V rail), and a smaller DC-DC (which generates the +/- 5V used for everything else).  The large DC-DC is almost identical in overall topology and control scheme to the other aerospace DC-DC module I opened already; go look at that one for details on the circuitry.  The only high-level difference is just that these have bipolar outputs, and so use the split secondary winding differently with an extra pair of diodes - except for that, they've got the same single-transistor forward converter topology, the same inductively-isolated control section which is likely sending a peak current setpoint from output to input side, and the same current transformer on the input.

This is the large DC-DC:




...and this is the small DC-DC: one unique part about it is the output common-mode choke at the bottom-right.  It's still very similar to the other DC-DCs, although with the lower power level, the lack of output buck inductor, and only a single power diode per output, I think it's a flyback rather than a forward converter.  (Could be doing something weird like operating discontinuous and using some intentionally-high transformer leakage inductance as the buck inductor, but that feels a whole lot less likely)



 
The following users thanked this post: SeanB, xrunner, ch_scr

Offline PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5162
  • Country: nl
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #15 on: July 07, 2024, 08:23:20 am »
Very interesting again! It looks like (part of) the bias circuitry was in the lower left corner of the PA board, since both inputs of the final stage and the temperature sensor seems to connect there. However, what ever lived there has been brutally removed, even taking some traces off the board.
Keyboard error: Press F1 to continue.
 

Offline D StraneyTopic starter

  • Regular Contributor
  • *
  • Posts: 230
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #16 on: July 07, 2024, 03:52:26 pm »
Very interesting again! It looks like (part of) the bias circuitry was in the lower left corner of the PA board, since both inputs of the final stage and the temperature sensor seems to connect there. However, what ever lived there has been brutally removed, even taking some traces off the board.
Good spotting: it's hard to see from these photos, but that area (besides the couple diodes & caps) has mostly square pads with solder on them, which look very much like they had discrete wire connections off-board.  As you say, looks like someone pulled hard on those temperature sensor wires rather than snipping them.  So that's why I'm guessing there was some biasing happening on an additional missing board, where these wires connected.  I looked at the discrete-wire connection points on both the digital board and the power board, but neither of them had any connections that would make sense for the temperature sensor.

Offline helius

  • Super Contributor
  • ***
  • Posts: 3659
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #17 on: July 08, 2024, 02:59:24 am »
Quote
I'm not sure exactly what this is storing; can't imagine it's the FPGA configuration but I don't see a dedicated EEPROM for that,
The Actel FPGAs are Flash-based (non-volatile configuration), so they do not require any external storage or initialization.
 
The following users thanked this post: D Straney

Offline radar_macgyver

  • Frequent Contributor
  • **
  • Posts: 705
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #18 on: July 08, 2024, 03:12:14 am »
Note that case surfaces are coated with conductive yellow metal (gold solution?) and most walls/surfaces have RF absorbers.
That's likely a hexavalent chromium conversion coating (aka 'alodine') - makes the aluminum conductive. Otherwise, it passivates by forming an oxide layer that is insulating.

Coax connectors: There were some extra little spring-loaded adapters on the Modulator board coax connectors, that had a lot of "play"; I don't know if this is the equivalent of a helical shaft coupling but for coax, to keep vibration and shock from being transmitted to the soldered connector?  I can imagine on a launch vehicle, even a short length of well-secured cable could pick up a good deal of inertia.


These look like SMP or SMPM connectors with spring loading. The play is deliberate, to allow misalignment between the module and whatever it connects to. You can find similar connectors on Digikey for backplane connections.

https://www.digikey.com/en/products/detail/amphenol-sv-microwave/1132-4114/16400285

Thank you for the teardown pics, this is really cool stuff!
 
The following users thanked this post: D Straney

Offline quince

  • Contributor
  • Posts: 35
  • Country: de
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #19 on: July 09, 2024, 09:38:48 am »
Hard to believe they just used some folded and tacked gold foil to bridge the microstrip between ceramic boards
 

Offline SeanB

  • Super Contributor
  • ***
  • Posts: 16347
  • Country: za
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #20 on: July 09, 2024, 12:25:48 pm »
Plus the BeO marking on the linear regulators, must be  nice hybrid package there is they used that, and worth opening as well. Likely all discrete IC's there, with some nice bonding wires joining them all together.
 

Offline AnalogTodd

  • Regular Contributor
  • *
  • Posts: 100
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #21 on: July 09, 2024, 01:48:51 pm »
Plus the BeO marking on the linear regulators, must be  nice hybrid package there is they used that, and worth opening as well. Likely all discrete IC's there, with some nice bonding wires joining them all together.
I think I recognize the part used (MSK5900). That is more than likely a handful of passives with two die; first would be the PNP output transistor and the other is the RH version of the LT1573. MS Kennedy did a lot of work with LTC devices in packaging up RH parts we put out.
Lived in the home of the gurus for many years.
 

Offline D StraneyTopic starter

  • Regular Contributor
  • *
  • Posts: 230
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #22 on: July 09, 2024, 11:01:44 pm »
I think I recognize the part used (MSK5900). That is more than likely a handful of passives with two die; first would be the PNP output transistor and the other is the RH version of the LT1573. MS Kennedy did a lot of work with LTC devices in packaging up RH parts we put out.
Yep that's right!  Haven't gotten the die under a microscope yet so can't confirm 100% yet that it's LTC, but you sure can see the big-ass pass transistor.


Similarly, took the lid off the "possibly two amplifiers/buffers" mystery device, and can see that it's a single die with a strange grid pattern.  Looking forward to getting this one under the microscope too to see what's going on.
 
The following users thanked this post: SeanB

Offline AnalogTodd

  • Regular Contributor
  • *
  • Posts: 100
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #23 on: July 10, 2024, 07:28:11 pm »
I think I recognize the part used (MSK5900). That is more than likely a handful of passives with two die; first would be the PNP output transistor and the other is the RH version of the LT1573. MS Kennedy did a lot of work with LTC devices in packaging up RH parts we put out.
Yep that's right!  Haven't gotten the die under a microscope yet so can't confirm 100% yet that it's LTC, but you sure can see the big-ass pass transistor.
Yes, I recognize the die after having worked with it over the years. If you go to the SMD document at https://www.analog.com/media/en/technical-documentation/controlled-drawings/05-08-5223.pdf you can see the pad locations of the die are a simple 180 rotation of how it is mounted in the package. It looks like they did a laser trimming of the resistor in series with the base of the PNP to help get a consistent current limit as well.
Lived in the home of the gurus for many years.
 

Offline D StraneyTopic starter

  • Regular Contributor
  • *
  • Posts: 230
  • Country: us
Re: Avionics reverse-engineering: spacecraft equipment
« Reply #24 on: July 11, 2024, 02:54:32 am »
Very cool!  Yes I see exactly what you mean.

Tonight was the Night of the Free Microscope Time, so die shots for everyone.  I got a nice up-close shot of that particular controller:


Pass transistor in the linear regulator is less exciting, but I still like seeing that familiar winding pattern:


Also check out the mystery device from the modulator board: it fits my circuit-functionality expectations by being a transistor array:

I wonder if the metal layer was customized for each application (like with many digital ASICs).  First thought was that only the working transistors were connected, but that doesn't make sense as probing each one with an automatic tester, without any kind of bond pads, seems wildly unrealistic.
Edit: This is actually the HFA3127 "ultra-high frequency" transistor array.  The many unused transistors makes me wonder if all 4 products in that datasheet share the same die, so that all 20+ transistors are always on the die, but only the metallization changes based on the part number.

Can you do a close-up photo of glass encapsulated transistors?

Done - here's one of each type.








The one-off transistor boosting the DRO output is especially nice to look at:

« Last Edit: July 11, 2024, 03:59:15 am by D Straney »
 
The following users thanked this post: SeanB, quince


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf