CC Technical Documentation RM-11 Series Transceivers Troubleshooting - Baseband Issue 1 02/2004 Confidential ©2004 Nokia Corporation
RM-11 Troubleshooting - Baseband CC Technical Documentation Contents Page Troubleshooting Overview ............................................................................................ 4 Power Up and Reset .....................................................................................................6 Power Up - Power Key.............................................................................................. 8 Power Up - Charger.........................................................
CC Technical Documentation RM-11 Troubleshooting - Baseband Flash Programming Does Not Work .........................................................................45 Phone is Jammed .......................................................................................................47 Power Does Not Stay on or the Phone is Jammed .....................................................48 Charger Faults .......................................................................................................
RM-11 Troubleshooting - Baseband CC Technical Documentation Troubleshooting Overview The baseband module of the RM-11 transceiver is a trimode, CDMA, dual-band engine and consists of three main Application Specific Integrated Circuits (ASICs): • Universal Energy Management (UEM) • Universal Phone Processor (UPP) • A 128-Megabit FLASH The baseband architecture is based on the DCT4 Apollo engine and supports a power-saving function called sleep mode.
RM-11 Troubleshooting - Baseband CC Technical Documentation VBatt PRODTP VPP GPS BB_RF Battery FM Radio Camera DC/DC Flash GenIO Control Charger Bottom Conn. MBus FBusRx FBusT x UPP VIO UEM ExtBusC SIM Reader VANA VR1A Vflash1 VR1B VR2 CBus Core Vflash2 DBus VSIM MBus VR3 VR4 Sleep Clk 32 KHz FBus VR5 VR6 VR7 VCTCXO 19.
RM-11 Troubleshooting - Baseband CC Technical Documentation Power Up and Reset Power up and reset are controlled by the UEM ASIC. The RM-11 baseband can be powered up in the following ways: • By the Power button, which means grounding the PWRONX pin of the UEM • By connecting the charger to the charger input • By the RTC alarm, when the RTC logic has been programmed to give an alarm After receiving one of the above signals, the UEM counts a 20ms delay and enters into reset mode.
RM-11 Troubleshooting - Baseband CC Technical Documentation Reference signal PwrOnX Charger Detection RTC UEMRSTX VFlash1 VIO VCORE VANA VR3 19.
RM-11 Troubleshooting - Baseband CC Technical Documentation Figure 3: Power up Power Up - Power Key When the Power key is pressed, the UEM enters the power up sequence. Pressing the Power key causes the PWRONX pin on the UEM to be grounded. The UEM PWRONX signal is not part of the keypad matrix. The Power key is only connected to the UEM. This means that when pressing the power key, an interrupt is generated to the UPP that starts the MCU.
RM-11 Troubleshooting - Baseband CC Technical Documentation Monitoring the VBAT voltage level is done by the charge control block (CHACON). A MSTRX='1' output reset signal (internal to the UEM) is given to the UEM's RESET block when the VBAT>VMSTR+ and UEM enter into the reset sequence. If VBAT is detected to fall below VMSTR- during start-up charging, charging is cancelled. It will restart if new rising edge on the VCHAR input is detected (VCHAR rising above VCH-ET+).
RM-11 Troubleshooting - Baseband CC Technical Documentation In the ACTIVE mode, the phone is in normal operation; scanning for channels, listening to a base station, and transmitting and processing information. There are several sub-states in the active mode depending on the phone’s present state, such as burst reception, burst transmission, if DSP is working, etc. In active mode, SW controls the UEM RF regulators: VR1A and VR1B can be enabled or disabled. These regulators work of the UEM charge pump.
RM-11 Troubleshooting - Baseband CC Technical Documentation The RM-11 baseband is powered from five different UEM regulators: Table 1: RM-11 Baseband Regulators Maximum current (mA) Vout (V) Notes VCORE DD/DC 300 1.5 Output voltage selectable 1.0V/1.3V/1.5V/1.8V Default power at power-up is 1.5V VIO 150 1.8 Enabled always except during power-off mode VFLASH1 70 2.78 Enabled always except during power-off mode VFLASH2 40 2.78 Enabled only when data cable is connected VANA 80 2.
RM-11 Troubleshooting - Baseband CC Technical Documentation Figure 4: 19.2 MHz analog RFConvClk (19.2 MHz Digital) The UPP distributes the 19.2 MHz Clk to the internal processors, DSP, and MCU, where SW multiplies this clock by seven for the DSP and by two for the MCU. Figure 5: 19.
RM-11 Troubleshooting - Baseband CC Technical Documentation CBUSClk Interface A 1.2 MHz clock signal is used for CBUS, which is used by the MCU to transfer data between the UEM and UPP. Figure 6: 1.2 MHz CBUS clock signal DBUS Clk Interface A 9.6 MHz clock signal is used for DBUS, which is used by the DSP to transfer data between the UEM and the UPP. Figure 7: 9.
RM-11 Troubleshooting - Baseband CC Technical Documentation The system clock can be stopped during sleep mode by disabling the VCTCXO power supply from the UEM regulator output (VR3) by turning off the controlled output signal SLEEPX from the UPP. SleepCLK (Digital) The UEM provides a 32 kHz sleep clock for internal use and to the UPP, where it is used for the sleep mode timing.
CC Technical Documentation RM-11 Troubleshooting - Baseband SleepCLK (Analog) When the system enters sleep mode or power off mode, the external 32 KHz crystal provides a reference to the UEM RTC circuit to turn on the phone during power off or sleep mode. Figure 9: 32 KHz analog sleep clock signal Flash Programming Connections to Baseband The flash programming equipment is connected to the baseband using test pads for galvanic connection.
RM-11 Troubleshooting - Baseband CC Technical Documentation input data from the flash prommer. If the timer expires without any data being received, the MCU continues the boot sequence. The MBUS signal from the UEM to the external connection is used as a clock during flash programming. This means that the flash-programming clock is supplied to the UPP on the MBUSRX signal. The flash prommer indicates flash programming/reprogramming to the UEM by writing an 8-bit password to the UEM.
RM-11 Troubleshooting - Baseband CC Technical Documentation FLASH_1 CH1 = BSI CH2 = MBUS CH3 = FBUSTX CH4 = FBUSRX Measure points Production test pattern (J396) Figure 10: Flashing start This boot code asks the MCU to report the prommer phone’s configuration information, including the flash device type. Now the prommer can select and send the algorithm code to the MCU SRAM (and SRAM/Flash self-tests can be executed).
RM-11 Troubleshooting - Baseband CC Technical Documentation FLASH_3 CH1 CH2 CH3 CH4 = = = = PURX MBUS FBUSTX FBUSRX M easure points Production test pattern (J396) Data transfer has started (Fbus_Rx) Figure 12: Flashing, continued 2 Flash Programming Error Codes The following characteristics apply to the information in Table 3. • Error codes can be seen from the test results or from Phoenix's flash-tool.
RM-11 Troubleshooting - Baseband CC Technical Documentation Table 3: Flash programming error codes (Continued) Error Description Not Working Properly C106 "The Phone has not received Secondary code bytes correctly." Mbus from Prommer->UEM->UPP(MbusRx) FbusRx from Prommer->UEM->UPP FbusTx from UPP->UEM->Prommer C107 "The Phone MCU can not start Secondary code correctly." UPP C586 "The erasing status response from the Phone informs about fail.
RM-11 Troubleshooting - Baseband CC Technical Documentation Temperature and capacity information are needed for charge control. These resistors are connected to BSI and BTEMP pins of the battery connector. The phone has 100 kW pull-up resistors for these lines so that they can be read by A/D inputs in the phone.
RM-11 Troubleshooting - Baseband CC Technical Documentation Figure 15: Charging circuitry Charger Detection Connecting a charger creates voltage on the VCHAR input of the UEM. Charging starts when the UEM detects that the VCHAR input voltage level is above 2 V (VCHdet+ threshold). The VCHARDET signal is generated to indicate the presence of the charger for the SW. The charger identification/acceptance is controlled by EM SW.
RM-11 Troubleshooting - Baseband CC Technical Documentation Charge Control In active mode, charging is controlled by the UEM's digital part. Charging voltage and current monitoring is used to limit charging into a safe area. For that reason, the UEM has the following programmable, charging cut-off limits: • VBATLim1=3.6 V (Default) • VBATLim2L=5.0 V • VBATLim2H=5.25 V VBATLim1, 2L, 2H are designed with hystereses.
CC Technical Documentation RM-11 Troubleshooting - Baseband Display and Keyboard The RM-11 uses LEDs for LCD and keypad illumination. There are three LEDs for the LCD and eight LEDs for the keypad. The KLIGHT signal is used to drive the LED driver for the LCD and keyboard. The RM-11 also uses a color LCD. The interface utilizes a 9-bit data transfer and is similar to the DCT3-type interface, except the Command/Data information is transferred together with the data.
RM-11 Troubleshooting - Baseband CC Technical Documentation Figure 19: Circuit for the flashlight being driven by TK11851TL Camera This section describes the tests of the camera module part of baseband. All the other tests are described in the C-Rio BaseBand Test Specification document.
RM-11 Troubleshooting - Baseband CC Technical Documentation CamClk 9.6MHz Vctrl EXTCLK XSHUTDOWN CLK CE CamRxDa TXDA LCDCamClk DACLK Image data Camel Dune Camera Module BaseBand Hardware Accelerator Control LCDCamTxDa RXDA CamCSX CSX 2.8V 1.8V GND 2.8V 1.8V GND GND GND 1.8V 2.8V Figure 20: Camera and HWA connections to the baseband DC Measurements Table 4: Power supply characteristics Signal name Measured value (V) Min Typical Max Unit Description VIO 1.8 1.7 1.8 1.
RM-11 Troubleshooting - Baseband CC Technical Documentation Table 5: DC characteristics (Continued) Signal name Measured value (V) Min RxDa H = 1.76 ExtClk Typical Max Unit Description H: 0.7xVIO H: VIO V Data to receive L = -11m L: 0 L: 0.3xVIO H = 1.75 0.5Vp-p VIOp-p V All modes H: VIO L: 0.3xVIO V Logic O: shutdown 1Vp-p L = -12m VCtrl N/A H: 0.7xVIO L: 0 Note: H indicates high signal level and L indicates low signal level.
RM-11 Troubleshooting - Baseband CC Technical Documentation TxEnd-bit is set low ('0') by the camera. The camera can interrupt the baseband by driving TxDa low for at least one ExtClk cycle when not transferring an image. The interrupt is initiated by the falling edge of the signal. ExtClk is the external system clock for the camera module. The clock may be AC or DC coupled. Four fixed frequencies are available (8.4, 9.6, 9.72,13, and 16.8 MHz, each within +/-100kHz). VIO is a regulated 1.
RM-11 Troubleshooting - Baseband CC Technical Documentation Table 7: Power-up timing (Continued) Parameter Measured value Limit Notes t5 3.75ms >5ms Software dependent t6 N/A >0 SSDA and SSCL signals not used t7 N/A >8ms SSDA and SSCL signals not used UIF Interface Timing Measurements The purpose of this test is to measure the timing of UIF serial interface. The rise and fall times are also measured.
RM-11 Troubleshooting - Baseband CC Technical Documentation Table 8: Timing margins of serial interface for camera module Parameter Measured Value Min Time Max Time RxDa data set-up time (Tdis) 100ns 25ns RxDa data hold time (Tdih) 103.6ns 25ns CSX valid to DaClk high (Tcss) 106ns (DaClk cycle time)/2 DaClk high to CSX invalid (Tcsh) 209ns DaClk cycle time Camera interrupt (TxDa pin) (Tint) 204ns 1 x ExtClk cycle Output delay time (C=30pF) (Tod) 8.
RM-11 Troubleshooting - Baseband CC Technical Documentation FM Radio FM radio circuitry is implemented using a highly integrated radio IC (TEA5767HN). The MCU SW controls FM radio circuitry through a serial bus (GenlOS) interface.
RM-11 Troubleshooting - Baseband CC Technical Documentation level is found, the tuning system stops and the Found Flag bit is set to HIGH. If a band limit was reached during the search, the tuning system stops at the band limit, the Band Limit flag bit is set to HIGH, and the Found Flag is set to HIGH. While the WRITE/READ is LOW, data can be read by the UPP. At the rising edge of the BUS Clock, data will be shifted out of the register.
RM-11 Troubleshooting - Baseband CC Technical Documentation FM Radio Signals Before Radio On Figure 27: Ch1 : FMClk(32.
RM-11 Troubleshooting - Baseband CC Technical Documentation Accessories The RM-11 is designed to support Tomahawk and Universal Headset accessories, differential and single-ended, respectively. Detection of Tomahawk accessories is done through the ACI signal where the Universal Headset is detected on GenIO (21).
RM-11 Troubleshooting - Baseband CC Technical Documentation Figure 30: Charging sequence Notice in Channel 4 that PURX is released. This is when the phone operation goes from RESET mode to POWER_ON mode. Tomahawk Headset Detection Accessory detection in Tomahawk is done digitally.
CC Technical Documentation RM-11 Troubleshooting - Baseband Figure 31: A waveform of digital accessory detection FBus Detection FBus communication in Tomahawk is done through the following lines: • Pin 2 (Charge GND) • Pin 3 (ACI) • Pin 4 (Vout) • Pin 6 (FBus Rx) • Pin 7 (FBus Tx) Issue 1 02/2004 ©2004 Nokia Corporation Confidential Page 35
RM-11 Troubleshooting - Baseband CC Technical Documentation Figure 32: FBus communication in Tomahawk Accessory Detection Though ACI USB and Audio on (mono or stereo) and FM radio communication in Tomahawk are done through the following signals: Table 11: Accessory detection signals USB Audio/FM Pin 5 (USB Vbus) Pin 9 (XMic N) Pin 6 (USB +) Pin 10 (SMIC P) Pin 7 (USB -) Pin 11 (HSEAR N) Pin 8 (Data GND) Pin 12 (HSEAR P) Pin 13 (HSEAR R N) Pin 14 (HSEAR R P) Page 36 ©2004 Nokia Corporation Co
CC Technical Documentation RM-11 Troubleshooting - Baseband Figure 33: USB and Audio on (mono or stereo) and FM radio communication in Tomahawk RUIM (SIM CAR) RM-11 supports RUIM for China products. The following waveform can be used to verify that sim_vcc; sim_i/o, sim_clk, and sim_rst signals are activated in the correct sequence at power up. This picture can be taken when the RUIM is installed on the phone and measures the signals when the phone is turned on.
RM-11 Troubleshooting - Baseband CC Technical Documentation Figure 34: RUIM signal waveform Page 38 ©2004 Nokia Corporation Confidential Issue 1 02/2004
RM-11 Troubleshooting - Baseband CC Technical Documentation Test Points RM-11 BB test points, regulators, and BB ASICs.
RM-11 Troubleshooting - Baseband CC Technical Documentation Bottom View Figure 36: Bottom view Page 40 ©2004 Nokia Corporation Confidential Issue 1 02/2004
CC Technical Documentation RM-11 Troubleshooting - Baseband Camera Test Points Figure 37: Camera test points; top side under LCD module Issue 1 02/2004 ©2004 Nokia Corporation Confidential Page 41
RM-11 Troubleshooting - Baseband CC Technical Documentation Top Troubleshooting Map T op P hone totally dead YE S P hone dead YE S F las h faults YE S P hone is jammed YE S C harger faults NO F las h programming does n't work NO P hone does n't s tart up or phone is jammed NO C harging does n't work NO Page 42 ©2004 Nokia Corporation T op page 2 Confidential Issue 1 02/2004
RM-11 Troubleshooting - Baseband CC Technical Documentation T op 2 A udio faults YE S A udio faults YE S Dis play faults YE S K eypad faults NO Dis play or L E Ds not working NO K eypad does n't work E ND Issue 1 02/2004 ©2004 Nokia Corporation Confidential Page 43
RM-11 Troubleshooting - Baseband CC Technical Documentation Phone is Totally Dead Phone is dead Phone current is zero or too high? ¾ If current is zero, check X100 solder and make sure Vbatt connector makes contact. ¾ If current is too high, check for shorts. ¾ Make sure all BB regulators are at their respective voltage levels (VANA, VIO, VCORE, VFlash1, and VR3). See phone's top view diagram for test points. ¾ Make sure the System Clk is 19.
RM-11 Troubleshooting - Baseband CC Technical Documentation Flash Programming Does Not Work Flash faults Phone does not set Flashbus TXD line high after startup YES Measure BSI pulse during Flash programming. Is it OK? NO Check BSI line X100, C230, R203, R202 YES Measure FBusRx (2.78V) signal during flash programming from production pattern and test point TP03 (1.8V).
RM-11 Troubleshooting - Baseband CC Technical Documentation Flash faults, page 2 Reflow the flash. Is it OK? NO NO Can you read manufacturer ID and device ID? Reflow or change flash. Reflow the UPP.
RM-11 Troubleshooting - Baseband CC Technical Documentation Phone is Jammed Phone is jammed Check VBATT, VIO, VCORE, VFlash1, VANA, VR3 capacitors. Are they OK? (See phone top view diagram for capacitor locations) NO Measure VIO, VCORE, VFlash1, VANA, and VR3 voltages. Are they OK? YES Check BSI/BTEMP lines and VBATT lines. If OK, change UEM Repair NO YES Measure 32kHz Sleep Clk from test point J974 and J975. Is it OK? Measure 32kHz Clk crystal.
RM-11 Troubleshooting - Baseband CC Technical Documentation Power Does Not Stay on or the Phone is Jammed Phone is jammed, page 2 Phone shutdown after 32 seconds YES Has the phone been flashed? Flash the phone NO YES NO Reflow or change UPP and re-flash NO Measure DBusClk (9.6MHz), Data, and EnX signals at TP13, TP11, TP09. Is it OK? YES NO Reflow or change UEM and re-flash Reflow or change UPP NO Read phone info. Is it OK? Measure watchdog signal Cbus from test points TP15, TP08, TP05.
RM-11 Troubleshooting - Baseband CC Technical Documentation Charger Faults Charger faults Connect charger. Make sure battery is connected. Battery bar doesn't work (scroll) NO Retest NO Check X102, F100, L100, V100, C106, C110 NO Change UEM NO Change UEM YES Measure voltage over V100. Is it > 3.0 Vdc? YES Read BTEMP value. Is it ~25C (0319)? YES Remove (fuse) F100 and measure current.
RM-11 Troubleshooting - Baseband CC Technical Documentation Audio Faults Earpiece Audio faults Is the earpiece working? NO Change earpiece. Is it working now? YES Retest NO Set phone in Local Mode. Use Phoenix "Baseband Audio Control" and set the following: Enable Tx, Enable Rx, Select MIC2 (0dB), Enable earpiece, and enable digital loopback only. Inject a 1KHz sine signal 20mVp-p on XMIC.
RM-11 Troubleshooting - Baseband CC Technical Documentation Microphone Audio faults, page 2 Is the microphone working? NO Change the microphone. Is it working now? YES Retest NO Set phone in Local Mode. Use Phoenix "Baseband Audio Control" and set the following: Enable Tx, Enable Rx, Select MIC1, Enable HF only (differential). Talk through the microphone. YES Measure MICB1 voltage from MICP pads on bottom connector. Is it ~2.
RM-11 Troubleshooting - Baseband CC Technical Documentation Vibra Audio faults, page 3 Is Vibra working? NO Measure VBATT voltage pin 1 of M300. Is it OK? NO Check VBATT line YES Set phone in Local Mode. Use Phoenix "Message Sender" and navigate as follows: DEV_HOST-->DEV_PC--> PN_ACCESSORY--> PN_OBJ_ROUTING_REQ--> PN_OBJ_PC->UTID_100--> ACC_VIBRA_CTRL_REQ. Select "ACC_ON" and click "Send" YES Measure the UEM signal on pin 2 of M300.
RM-11 Troubleshooting - Baseband CC Technical Documentation Display Faults Display faults Are the Keyboard and LCD LEDs turned on when phone is turned on or when making a phone call? NO Measure VBATT voltage at R315. Is it OK? NO Check VBATT line at X100 connector and C109 YES Set phone to Local Mode. Use Phoenix "Message Sender" and navigate as follows: DEV_HOST--> DEV_PC-->PN_LIGHT--> OBJ_ROUTING_REQ-->OBJ_PC--> UTID-->LIGHT_CONTROL_REQ--> LIGHT_CONTROL_TARGER_KBD.
RM-11 Troubleshooting - Baseband CC Technical Documentation Display faults, page 2 Does the Display start? NO Try changing display module. Does it work? Retest YES NO YES Set phone in Local Mode. Use Phoenix "Message Sender" and navigate as follows: DEV_HOST-->DEV_PC--> PN_TEST-->OBJ_ROUTING_REQ--> OBJ_PC-->UTID--> TEST_UI_TEST_REQ--> TEST_DISPLAY_SET-->NUM_SB--> TEST_SB_UI_DISPLAY_PATTERN--> SB_LENGTH. Select "TEST_PATTERN_ALTPIXELS" and click "Send" Check VIO and VFlash1 at X302.
RM-11 Troubleshooting - Baseband CC Technical Documentation Keypad Faults Power Key Keypad faults Is the power key working? NO Measure voltage at R306. Is it high? NO Check S302, C310, and R306. If OK, change UEM YES Retest YES YES Keypad faults, page 2 Issue 1 02/2004 Measure voltage at R306 when power key is pressed.
RM-11 Troubleshooting - Baseband CC Technical Documentation UI Modules Keypad faults, page 2 Are UI modules keys working? NO Change keypads module. Is it working? YES Retest NO Make sure there are no shorts on Z300. If OK, change UPP NO Change Z300 NO Measure ROW0-4 (P10-P15) signals between UPP and X301. Are they ~1.8V? YES YES Measure COL1-4 (P01-P04) signals between UPP and X302. Are they ~1.8V? END Page 56 Make sure there are no shorts on Z300.
RM-11 Troubleshooting - Baseband CC Technical Documentation FM Radio FM Radio faults Is the FM radio working? NO Power on the phone and turn FM radio on by Phoenix NO Check solder on N356, X101, and replace N356 if not working. YES Measure VFlash2 (VCCD/VCCA/ VCCVCO) at C359/ C372/L357. Is it 2.8V? YES NO Check VFlash2 line YES Does the FM radio produce a "Bong" sound when changing channels (frequencies)? Measure FM1=1.8V, FM2=11 Khz, FM3=1.8V, and FM4=32 Khz.
RM-11 Troubleshooting - Baseband CC Technical Documentation FM Radio faults 2 Measure VREF at C365. Is it 1.6V? NO Check C365 NO Change FM Radio chip (N356) YES Measure VAFL/VAFR at C164/C168.
RM-11 Troubleshooting - Baseband CC Technical Documentation Camera Camera faults Power on the phone and turn camera on by Phoenix or UI menu NO Make sure soldering on X970 and D970 is OK and check PUSL(1) on R997.
RM-11 Troubleshooting - Baseband CC Technical Documentation Flashlight Flashlight faults Are the flashlight LEDs turned on when the phone is turned and when pressing the * key? NO Measure VBATT voltage at R315. Is it OK? NO Check VBATT line at X100 connector and C109 NO Change the UEM YES YES Measure the driver signal DLIGHT at V317 an dV301. Is the signal OK? YES Check N300, V301, L300, C302, C303, C304, R300, R307, R315, R316, R317 Flashlight OK YES Check solder joints at V304 and V303.
RM-11 Troubleshooting - Baseband CC Technical Documentation Figure 38: GPS block diagram The basic GPS BB troubleshooting method is to put the GE and CE in the proper mode and check to make sure that necessary inputs from the CE are good (power, clock, etc.). Then, ensure that these inputs produce the proper outputs. Because of the large level of integration (most functionality is contained in the two ASIC chips), the amount of diagnostics one is able to do is limited.
RM-11 Troubleshooting - Baseband CC Technical Documentation Vcore at 1.5V? Troubleshoot CE power supply Vio at 1.8V? NO GPS_RF_CLK (19.2MHz) OK? NO Troubleshoot CE VCTCXO circuit GPS_EN_RESET is held high? NO BB ASIC being held in reset, troubleshoot source in the CE GPS_SLEEPCLK (32.768KHz) OK? NO Troubleshoot CE sleep clock circuit VRF_GPS OK? NO VRF_GPS regulator enable line low? NO Replace regulator (N052) GPS_CLK (16.
