ST2132 Mobile Phone Trainer

(1)

Mobile Phone Trainer ST2132

Learning Material Ver 1.1

An ISO 9001:2008 company

94, Electronic Complex, Pardesipura Indore - 452 010 India Tel: +91-731 4211100 Fax: +91-731-2555643 e mail: [email protected] Websites: www.caddo.bz www.scientech.bz

(2)

(3)

Mobile Phone Trainer ST2132 Table of Contents 1. Introduction 6 2. Features 7 3. Technical Specifications 8 4. Safety Rules 9 5. Technology History 10 6. Getting Started 14 7. GMSK Modulation 14 8. GMSK 16

9. Introduction to Mobile Sections 17

• Receiver section 17

• Transmitter section 18

10. Experiments

• Experiment 1 19

Study of the Tx IQ/ Rx IQ signals

• Experiment 2 20

To observe signal constellation of GMSK signal

• Experiment 3 21

Study of the GSM data rate and GMSK encoded signal

• Experiment 4 23

To observe signal constellation of GMSK signal

11. Base Band Control 23

12. Network/ RF Section 23

• Experiment 5 25

Study of the System Clock

• Experiment 6 27

Study of the working of Audio IC

• Experiment 7 29

Study of Audio Signal

• Experiment 8 30

Study of the working of a SIM card in a GSM handset

• Experiment 9 32

Study of the SIMCARD Detection (Without SIM Card)

• Experiment 10 33

(4)

Scientech Technologies Pvt. Ltd. 4

Study of and measure the CLK of the SIM CARD

Study of the SIM CARD detection (with SIM CARD)

Study and Measure the charging phenomena in GSM handset

Study and Analyze the CCONT IC in a GSM Handset

Study and Measure the supplies generated by CCONT IC

13. Real Clock Time 45

Study of the RTC

14. Power Up and Power Down 47

Analyze the trainer (mobile phone) is partially ON when charger is connected

Analyze that a mobile phone is powered ON at the alarm Set Time

Analyze power ‘On/Off’ (PWRONX) signal is triggered with Low/grounded

Study of the power ‘Off’ triggered by low signal (ground)

15. Modes of Operation 50

Analyze the acting dead mode

Analyze the Sleep mode

16. User Interface Section 52

Verify and Analyze the intensity is Hardware control

Study and Analyze the DC level of LED

(5)

• Experiment 26 57 Study and Measure the PWM signal of the Vibrator

Study and Analyze the Buzzer in a GSM Handset

Study and Measure the PWM signal of the Buzzer

Study of the Keypad of a GSM Handset

Study the Row /Column configuration of Matrix Keypad

Study and Analyze the LCD Module

Study and Measure the reset pin in LCD Module

Verify and Study the importance of the voltage Tripler in the LCD Module

Verify and Measure the control pin of the LCD Module

Study of the clock pin of a LCD Module

17. Memory 70 18. CPU 72 19. Test Points 74 20. Component Layout 76 21. Frequency List 77 22. Network Coverage 77 23. Word 79

24. Frequency Asked Question 80

25. Glossary 81

26. Service Tips 82

27. Warranty 84

(6)

Scientech Technologies Pvt. Ltd. 6 Introduction

Scientech's model ST2132 Mobile Phone Trainer is a unique training equipment to understand the working of a mobile phone.

Mobile phone can be described, a product designed to global standards & has a leading processor state of the art power system, an ultra compact mechanical design and an operating system with feature set which makes its studying a necessity.

Mobile Phone Trainer ST2132 is the perfect product for today's global technical profession. One of the main features of the trainer is its real time signals. The trainer provides 41 test points which gives a full view of the working of a mobile phone. The UI section of the mobile phone that's Vibrator, Buzzer, and LED has been replaced with normal components instead of SMD for expansion and detailed study.

We hope our attempt will help the user to understand the working operation of GSM mobile phone.

(7)

RoHS Compliance

Scientech Products are RoHS Complied.

RoHS Directive concerns with the restrictive use of Hazardous substances (Pb, Cd, Cr, Hg, Br compounds) in electric and electronic equipments.

Scientech products are “Lead Free” and “Environment Friendly”.

It is mandatory that service engineers use lead free solder wire and use the soldering irons upto (25 W) that reach a temperature of 450°C at the tip as the melting temperature of the unleaded solder is higher than the leaded solder.

Features • Real Time Mobile Operation

• Expanded and Open Trainer

• Full understanding of Mobile Phone Working • Provides study of all sections in Mobile Phone • Tx/Rx frequency measurement

• 2G technology GMSK signal • GSM Data Rate

• Detail study of User Interface Control Signals • Detail study of SIM Operation

• Battery Identification and Charging Study • Switched Faults

(8)

Scientech Technologies Pvt. Ltd. 8 Technical Specifications

Cellular System : EGSM/GSM 900

Rx Frequency Band : EGSM 925 …..960 MHz GSM 900 935 ….960 MHz Tx Frequency Band : EGSM 880 …..890 MHz

GSM 900 890 ……915 MHZ

Output Power : +5… +33dBm/3.2mW… 2 W

Channel Spacing : 200 KHz

Antenna : Loop type, 50 ohms Display : 84 x 48 pixels

On board Sections : Antenna, Keypad, SIM, Charging Circuit, Clock, User interface: Buzzer, Vibrator, LEDs. No. of Test Points : 41 Nos.

No. of Switched Fault : 25 Nos.

Features that can be Set : Screen saver, Ring tones, Logos, SMS etc. Power Supply : 100 to 240V; 50- 60 Hz

Power Consumption : 3.6 Watts (Approximately) Fuse : 1.5 amps

Dimension (mm) : W 450 x H 113 x D 280.

(9)

Safety Rules

• Handle carefully as you use your own mobile phone.

• Don’t short any test point or switched faults. It may result in permanent damage.

• Don’t leave the trainer open for a long time. Since moisture may damage.

• Don’t put the battery other than supplied with the trainer else warranty void.

• Don’t keep the mains cord or charging ON for long period, this may damage the

Battery/trainer.

• Don’t connect the test probe unnecessary/much prior to the experiment.

• Remove the test probe in 4-5 seconds.

• If no network indications try SIM card of other service provider in the 900 MHz

band.

• Avoid other mobile phones near to the trainer while performing experiments.

• Don’t try or alter “Security” or Lock code options of the mobile phone trainer.

• Keep intensity of LED at low for better battery performance.

• Vibrator mode doesn’t operate whenever the trainer is in charging ON mode.

(10)

Scientech Technologies Pvt. Ltd. 10 Technology History

Mobile Phone Patents :

Dr Martin Cooper, a former general manager for the systems division at Motorola, is considered the inventor of the first modern portable handset. Cooper made the first call on a portable cell phone in April 1973. He made the call to his rival, Joel Engel, Bell Labs head of research. Bell Laboratories introduced the idea of cellular communications in 1947 with the police car technology. However, Motorola was the first to incorporate the technology into portable device that was designed for outside of a automobile use. Cooper and his co-inventors are listed: Martin Cooper, Richard W. Dronsuth; Albert J. Mikulski, Charles N. Lynk Jr., James J. Mikulski, John F. Mitchell, Roy A. Richardson, John H. Sangster .

By 1977, AT&T and Bell Labs had constructed a prototype cellular system. A year later, public trials of the new system were started in Chicago with over 2000 trial customers. In 1979, in a separate venture, the first commercial cellular telephone system began operation in Tokyo. In 1981, Motorola and American Radio telephone

started a second U.S. cellular radio-telephone system test in the

Washington/Baltimore area. By 1982, the slow-moving FCC finally authorized commercial cellular service for the USA. A year later, the first American commercial analog cellular service or AMPS (Advanced Mobile Phone Service) was made available in Chicago by Ameritech.

Despite the incredible demand, it took cellular phone service 37 years to become commercially available. Consumer demand quickly outstripped the 1982 system standards. By 1987, cellular telephone subscribers exceeded one million and the airways were crowded.

An overview of GSM network GSM network :

The GSM Network comprises three parts, Mobile Station (MS) which is similar to a cordless phone with extra features, the Base Transceiver Station (BTS) that controls the connection with the Mobile Station, the Base Station Controller (BSC) that controls multiple Base Transceiver Station's and then the rest of the network covered further below.

Mobile Station (MS) :

A Digital Mobile Phone and a SIM card make up the Mobile Station. The SIM (Subscriber Identity Module) is a card that fits into your handset. The SIM microprocessor is based on a silicon chip which is designed to tolerate temperatures

between -25°C and +70°C, and will also withstand up to 85% humidity. However

silicon is fragile and therefore, if the card is tampered with, physically or electronically, the card will be rendered useless. The SIM contains all of your identification details, such as your IMSI (International Mobile Subscriber Identity. This is a numeric string, where the first 3 digits represent the country where the SIM is from, the next represent the operator in that specific country. The other digits

(11)

represent the subscriber’s identity in his home-network), phone memories, billing information, SMS text messages, pin numbers and international roaming information. A IMEI (International Mobile Equipment Identity) card is the serial number of the GSM phone. The SIM card contains a IMSI (International Mobile Subscriber Identity) number that identifies the user to the network along with other user and security information.

Base Transceiver Station (BTS) :

The Base Transceiver Station consists of a radio transceiver with antenna that covers a single cell. It handles the communications with the MS via radio interface. BTS are all connected together to allow you to move from one cell to another. The antenna can take on various forms.

Base Station Controller (BSC) :

The Base Station Controller manages multiple BTSs. It controls the allocation and release of radio channels and handovers between cells. A series of BTSs are connected to each Base Station Controller, the BSC keeps a eye on each call and decides when to pass the call off to another BTS and to which one.

The Rest of the Network :

Several BSCs are controlled by the Mobile service Switching Center (MSC), the MSC works with four databases (HLR, VLR, EIR and the AUC) and together they manage the communications between Mobile Station user and the other network types. Each of the databases has a separate job.

Mobile Switching Center (MSC) :

The Mobile Switching Center is the interface between the base station system and the switching subsystem of the mobile phone network. Furthermore, the MSC is also the interface between the cellular network and the PSTN. The MSC generates all billing records and ensures that all usage is directed to the appropriate account. The MSC has a relatively complex task, as unlike a conventional telephone exchange, when GSM subscribers make calls they could be anywhere within the network. The MSC must ensure that calls are routed through to those subscribers, wherever they are and wherever they move to throughout the duration of each cell. This situation becomes even more complex when two mobile subscribers wish to contact each other from two distant locations.

In order to simplify the subscriber management function, a specific service area is allocated to each MSC. The MSC has to control the switching of tariff to and from the subscribers within its service area which involves the co-ordination of all radio resources and the inter cell hand-off activities.

Home Location Register (HLR) :

The HLR is the central data base for all the subscribers which contain details on the identity of each subscriber, the services to which they have access and the locations where the subscriber was last registered.

(12)

Scientech Technologies Pvt. Ltd. 12 Once the Mobile Stations MSISDN has been used to identify the IMSI, the HLR verifies the subscription records to ensure that the call can be delivered to the last known location of the Mobile Station.

Visitor's Location Register (VLR) :

The VLR is a database that is linked to an MSC and temporarily stares information about each Mobile Station within the area served by that MSC.

Equipment Identity Register (EIR) :

The EIR ensures that all Mobile Equipments are valid and authorized to function on the PLMN.

Authentication Center (AUC) :

The authentication center is used to validate the SIM Card being used by the Mobile Station. Secret information that is held in the AUC and which is also contained within the SIM Card is used to perform a complex mathematical calculation. Authentication occurs if the results of these two calculations agree.

• SMSC (SMS Center or Service Center), the SMSC handled all the SMS

messages that are sent. The messages are sent on a data channel so you can receive them while on a call.

• GMSC (Gateway MSC) is a gateway switch where the call is directed when

setting up a call to a GSM user. The GMSC looks for the subscriber by interrogating the right HLR which then interrogates the VLR and routes the incoming call towards the MSC where the subscriber can be reached.

Outstanding Features Quality :

With digital, sound quality is sharp and clear. Background sounds and static are vastly reduced and crossed-line conversations are also eliminated. In comparison with analog there are also far fewer dropouts, and overall the quality is more like that of a fixed telephone.

Security :

Unlike analog, everything you say and send within the digital network is safe and secure. Some features are user authentication that prohibits unauthorized access, encryption key distribution that guarantees the privacy of the call and caller identification restrictions that can prevent the delivery of the calling user’s number to the receiver.

Convenience :

With digital, better technology means better battery life. You get up to twice as much talk time from each battery charge, compared with analog. In addition the digital service allows more calls to be handled at any one time, therefore reducing congestion in areas of dense population and high usage.

(13)

Roaming :

Roaming is one more feature of GSM technology. With digital, you are able to use your mobile phone, and number in other countries around the world that operate a GSM network. Features : • Call Forwarding • All Calls • No Answer • Engaged • Unreachable • Call Barring

• Outgoing - Bar certain outgoing calls(e.g. ISD)

• Incoming - Bar certain incoming calls (Useful if in another country)

• Global roaming - Visit any other country with GSM and a roaming agreement

and use your phone.

• SMS - Short Message Service - Allows you to send text messages to and from

phones

• Multi Party Calling - Talk to five other parties as well as yourself at the same

time

• Call Holding - Place a call on Hold

• Call Waiting - Notifies you of another call whilst on a call

• Mobile Data Services - Allows handsets to communicate with computers

• Mobile Fax Service - Allows handsets to send, retrieve and receive faxes

• Calling Line Identity Service - This facility allows you to see the telephone

number of the incoming caller on our handset before answering

• Advice of Charge - Allows you to keep track of call costs

• Cell Broadcast - Allows you to subscribe to local news channels

• Mobile Terminating Fax - Another number you are issued with that receives

faxes that you can then download to the nearest fax machine.

• Available by 1998

• Upgrade and improvements to existing services

• Majority of the upgrade concerns data transmission, including bearer services

and packet switched data at 64 K bit/s and above

(14)

Scientech Technologies Pvt. Ltd. 14 Getting Started

1. Check the battery is received in proper condition.

2. Insert SIM card of any 900MHz service provides in the SIM assembly.

3. Now, insert the battery so that the battery contacts and assembly terminal

match.

4. Switch ‘On’ the trainer by pressing the power ‘On/Off’ switch, located at the

top right most corner.

Note : Whenever the switch is operated ‘On/Off’ LED operates.

5. When/If the battery is low. Connect the mains cord and operate the charging

switch located at the top right most corner below the power switch.

6. Mode : This is an improved feature of ST2132. The mode has to be selected prior to switching ON the trainer.

a. DC Mode :

In normal switch position, trainer operates with battery supplied & charging facility functions normally.

b. AC Mode :

When switch pressed trainer operates on AC & mains cord is a must for the supply. The trainer automatically disconnects the battery contacts when the mode is changed from DC to AC. So physical presence of the battery in the battery assembly doesn’t have any effect.

The charging ‘On/Off’ switch stops functioning in this mode.

(15)

GMSK Modulation

GSM uses a digital modulation format called 0.3GMSK (Gaussian minimum shift keying). The 0.3 describes the bandwidth of the Gaussian filter with relation to the bit rate. The bandwidth of 0.3 was chosen as a compromise between spectral efficiency and inter symbol interference.

GMSK is a special type of digital FM modulation. 1s and 0s are represented by shifting the RF carrier by plus or minus 67.708 KHz. Modulation techniques which use two frequencies to represent one and zero are denoted FSK (frequency shift keying). In the case of GSM the data rate of 270.833 Kbit/sec is chosen to be exactly four times the RF frequency shift. This has the effect of minimizing the modulation spectrum and improving channel efficiency. FSK modulation where the bit rate is exactly four times the frequency shift is called MSK (minimum shift keying). In GSM, the modulation spectrum is further reduced by applying a Gaussian pre-modulation filter. This slows down the rapid frequency transitions, which would otherwise spread energy into adjacent channels.

0.3GMSK is not phase modulation (i.e. information is not conveyed by absolute phase states, as in QPSK for example). Its the frequency shift or change of phase state which conveys information. GMSK can be visualized from an I/Q diagram. Without the Gaussian filter, if a constant stream of 1s is being transmitted, MSK will effectively stay 67.708 KHz above the carrier centre frequency. If the carrier centre frequency is taken as a stationary phase reference, the 67.708 KHz signal will cause a steady increase in phase. The phases will role 360 degrees at a rate of 67,708 revolutions per second. In one bit period (1/270.833 KHz), the phase will get a quarter of the way round the I/Q diagram or 90 degrees. 1s are seen as a phase increase of 90 degrees. Two 1s causes a phase increase of 180 degrees, three 1s 270 degrees and so on. 0s cause the same phase change in the opposite direction.

The exact phase trajectory is very tightly controlled. GSM use’s digital filters and I/Q or digital FM modulators to accurately generate the correct trajectory. The GSM specification allows no more than 5 degrees rms and 20 degrees peak deviation form the ideal trajectory.

(16)

Scientech Technologies Pvt. Ltd. 16 GMSK

(17)

Introduction to Mobile Section Description of block diagram :

For understanding the basic circuit of any mobile phone it can be divided in following three sections:

A. Receiving Section

B. Transmitting Section

C. Base band Control/UI Section

Receiver Section A. Receiver Section :

The receiver is direct conversion dual band linear receive. When any call is received in mobile phone, the receiving signal comes at antenna first, which is of loop type then to pin no.4 of antenna switch (Diplexer) (Z502) through capacitor C593. This antenna switch makes function of switching of receiving, transmitting, GSM and DCS frequency band. Switching signals is given at its control pins from CPU for it, GSM-RX signal is made out from pin no.14 of antenna switch, which is given to pin no.7 of Z501 through capacitor C547 receiving signal passes through band pass SAW (Surface acoustic wave) filter (925-960MHz) and is made out from pin 1.

Unwanted frequencies coming with GSM frequency bands are filtered by it and only required band frequencies are passed further. Signal obtained from filter is given to LNA (Low Noise Amplifier) V501. Control voltage is given to amplifier from HAGAR IC N500; amplification gain of LNA is controlled by it. Because this control voltage controls gain of amplifier in automatic way hence considered AGC (Automatic Gain Control). Output level of receiver remains stable by it.

Signal obtained from amplifier gain is given to Band Pass SAW filter Z500, signal obtained from pin no.4 of V501 is given to pin no.1 of Z500. Many unwanted frequencies are amplified with the amplification receiving signals. It is very essential to separate these frequencies, otherwise further these frequencies can become reason of noise. Band Pass Filter Z500 makes this function; signal is made out from its one output pin no.7 and given to balancing transformer T501. The balancing transformers make balancing from single ended receiving signal. Signal is made balance by transformer T501 and comes at pin no.C9 and B9 of IC N500, which are input pins of GSM-RX of N500 RF IC (HAGAR IC).

Mixing and Demodulation (conversion to LF) operation of receiving signal is made in HAGAR IC N500. Oscillation signal produced by VCO (Voltage Controlled Oscillator) G500 is mixed in these signals for this operation. This VCO (Voltage Controlled Oscillator) G500 produces separate local oscillation signals in GSM and DCS frequency band. VCO produces 3700-3840 MHz for GSM and 3610-3760 MHz for DCS 1800. This signal is given to pin no. J2 and J5 of IC N500 through signal transformer T502, this signal is amplified in IC. It is divided by four, for GSM (local oscillation signal of 935 to 960 MHz) is obtained and by 2 for DCS 1800 PLL and dividers are in HAGAR IC. GSM receiving signal is mixed in this signal, after that it

(18)

Scientech Technologies Pvt. Ltd. 18 is filtered and given to demodulator and made I/Q signal. This receiving I/Q signal is made out from pin numberG5 and G6 of IF IC N500 which can be viewed at (3) and (4), which is given to audio signal COBBA IC N100.

Demodulation is completed digital to analog conversion and audio frequency amplification etc functions are made in it. It also makes functions as interface for completing control functions of AFC, PAC and AGC etc CPU D300 has full control of all functions of this IC. Audio frequency signal is obtained in this IC through a PCM signal. This is amplified by audio frequency amplifier. This audio frequency signal is obtained from pin no.D1 and D2 of COBBA IC N100, it is given to speaker and sound is obtained.

Transmitter Section B. Transmitter Section :

At the time of transmitting microphone converts voice signal in to electric signal. This signal is given to pin no. A3 & B3 of audio frequency processing IC N100. Transistor V101 connected from pin no.D6 of this IC is a mic power supply controller transistor. This transistor provides control voltage to microphone signal given by microphone is at first amplified in COBBA IC N100. After that it is made PCM code and digital signal is obtained, this signal is sent to central processing unit D300 for voice coding and channel coding at that place data stream is made which is sent back to audio processing IC N100 for GMSK modulation. In this way A/D conversion, coding, Encryption channel coding and modulation etc functions are made in COBBA IC and CPU. I/Q signals are serially transmitted from COBBA IC and given to transmitting modulation process in HAGAR IC N500 which can measured at (5) and (6).

VCO signals are mixed with TX-IQ signal in HAGAR IC N500. These local oscillation signals are produced by local oscillation modules G-500, VCO module G500 generates local oscillation signals of two different values. Oscillation signals 3520 to 3660 MHz in condition of GSM 900 frequency band, which is divided by four, 890 to 915 MHz is obtained and mixed with transmitting I, Q (TX-1, Q) signal. Signal output level at this stage is 5dBm Working system of VCO module G500 is controlled by PLL circuit made in HAGAR IC N500.

After the modulation, Tx signal is converted to single ended by balance circuit (mutual coupler) and after filtering in 2500 (880…915Hz) the signal is amplified by pre-amplifier circuit and buffered out the final amplification is realized with dual band power amplifier. It has a gain control, which is controlled with a power control loop in HAGAR IC. Power amplifier produces a signal over 2W in GSM band. Gain control range is over 35dBm.

Now this signal is given to Dual band directional coupler connected between PA and Antenna switch, Directional coupler take a sample from the forward going power with certain ratio. This detected voltage is compared in error amplifier in HAGAR IC to a Tx voltage generated by COBBA IC. Then the signal is given to Antenna switch and the signal is transmitted through antenna, the signal is of +33dBm approximately. Note : Before performing the observation, fully charged the battery and keep the charging ‘On’.

(19)

Experiment 1 Objective: Study of the Tx IQ/Rx IQ signals Procedure:

1. Insert the SIM and power ‘On’ the trainer.

2. Make a Call to the trainer or from the trainer

3. Keep the Call ‘On’.

• Connect the probe of spectrum analyzer at (1) and observe the signal in the

Tx band.

• Now connect the probe to (2) observe the signal in the Rx band.

• Connect two probe of CRO one at (3) & the other on (4) observe the Rx

burst. A similar Tx burst can be observed by connecting probe (5) & (6) respectively. Signal figure shows an IQ Tx/Rx burst signal.

(20)

Scientech Technologies Pvt. Ltd. 20 Experiment 2

Objective: Observe signal constellation of GMSK signal Procedure :

1. Make a call to the trainer.

2. Receive the call and keep ‘On’.

3. Connect two probe of CRO one at (3) & the other on (4) observe the Rx burst

signal figure shows an IQ Rx burst signal.

(21)

Experiment 3

Objective: Study of the GSM data rate and GMSK encoded signal Procedure :

1. Make a call to the trainer

2. Connect the probe of the CRO at (5) or (6)

3. Observe the signal as shown in figure a

4. Expand the signal to set the eye pattern.

Figure (a) Figure (b)

Figure 4

F = 1/T = 1 /2.95 x 5 x 10-6

= 67.708 KHz (approximately) = 67 x 4

270 K bits/s GSM data rate

5. Expand the signal.

6. Observe the GMSK encoded signal.

Figure (c)

(22)

Figure (d) Figure (e)

(23)

Experiment 4 Objective: Observe signal constellation of GMSK signal Procedure:

1. Make a call to the trainer.

2. Receive the call and keep ‘On’.

3. Now Connect two probe of CRO one at (5) & the other on (6) observe the Tx

burst in X-Y mode figure shows the time constellation of the GMSK signal. Base Band Control

A. Base band Control/UI Section :

This section contain base band, CPU, CCONT IC, Charging IC, UI circuit such as Buzzer, Vibrator, LED and memories flash/SRAM.

It makes functions for completing all functions of this mobile, checking them and controlling system. All system control, communication control, field strength testing, battery voltage and standby charge, key board scanning and display control, power supply control, power ‘On/Off’ control, sleeping state control etc.

Network/RF Section Antenna Switch :

The switch is normally open to the two RX outlets i.e. GSM_Rx and DCS_Rx. If no control voltage is present at VC1 or VC2 the RX/TX switch will work as a diplexer and the GSM900 signal is pass to GSM_Rx and the GSM1800 signal to DCS_Rx. It is a 16 pin module.

Power Amplifier (PA) :

PA consist a circuit of high frequency power amplifier. This is a dual band amplifier.

It has 50Ω Input and Output there is also again control with a power control loop in

HAGAR. The directional coupler takes a sample from the forward going power with certain ratio. This signal is rectified in Schottky diode and it produces a DC signal after filtering. The detected voltage is compared in the error amplifier in HAGAR to a Txc voltage generated by COBBA.

(24)

Scientech Technologies Pvt. Ltd. 24 Block Diagram of Power Amplifier

Figure 7 VCTCXO:

Voltage Controlled Temperature Compensated Crystal Oscillator. It produces a signal of 26MHz which is given to RF IC is after dividing the frequency by 2 it produces a signal of 13MHz which is used as system clock.

Note: Before performing the observation, fully charged the battery and keep the charging ‘On’.

(25)

Experiment 5 Objective: Study of the system clock

Procedure:

1. Switch ‘On’ the trainer with/without SIM.

2. Observe the 26MHz signal

Note: Remove the test probe as early as possible, since it may Hang the system or

Restart.

VCO (Voltage Controlled Oscillator) G500:

Local oscillation signals are generated by the VCO module. While reception it generates 3700-3840 MHz for GSM and 3610-3760MHz for DCS 1800. It is divided by four, for GSM (local oscillation signal of 935 to 960 MHz) is obtained and by 2 for DCS 1800 PLL and dividers are in HAGAR IC.

Oscillation signals 3520 to 3660 MHz in condition of GSM 900 frequency band, which is divided by four, 890 to 915 MHz is obtained and for 1800 MHz it is 3420MHz -3570MHz which is divided by 2.

RF IC (HAGAR IC):

Its a ASIC and BGA soldered. HAGAR consists of PLL, dividers, controlled through serial bus. DTOS amplifier (differential to single ended) and BIQUAD. The Tx/Rx signals are mixed with low frequency after passing through dividers. The selectivity of channels is also done by HAGAR through control signal from CPU such as SENA, SDATA it provides AGC of the received signal.

(26)

Scientech Technologies Pvt. Ltd. 26 Frequency Synthesizer :

VCO frequency is locked with PLL into stable frequency source, which is a

VCTCXO-module (Voltage Controlled Temperature Compensated Crystal

Oscillator). VCTCXO is running at 26 MHz. Temperature effect is controlled with AFC (Automatic Frequency Control) voltage. VCTCXO is locked into frequency of the base station. AFC is generated an 11 bit conventional DAC in COBBA. PLL is located in HAGAR RF-IC and is controlled via serial bus from COBBA-IC. There are 64/65 (P/P +1) prescaler, N- and A divider, reference divider, phase detector and charge pump for the external loop filter. SHF local signal, generated by a VCO-module (voltage controlled oscillator), is fed to prescaler, Prescaler is a dual VCO-modules divider. Output of the prescaler is fed to N- and A divider, which produce the input to phase detector. Phase detector compares this signal to reference signal (400 KHz), which is divided with reference divider from VCTCXO output. Output of the phase detector is connected into charge pump, which charges or discharges integrator capacitor in the loop filter depending on the phase of the measured frequency compared to reference frequency. Loop filter filters out the pulse and generates DC voltage to VCO.

Loop filter defines step response of the PLL (settling time) and effects to stability of the loop filter defines steps response step response of the PLL (setting time) and effects to stability of the loop, that’s why integrator capacitor has got a resistor for phase compensation. Other filter components are for sideband rejection. Dividers are controlled via serial bus. SDATA is for data, SCLK (serial clock) for the bus and SENA1 is a latch enable, which stores new data into dividers.

(27)

Experiment 6 Audio IC (COBBA IC) :

Objective : Study of the working of Audio IC Theory :

COBBA ASIC provides an interface between the base band and the RF-circuitry. COBBA performs digital to analog conversion of the receive signal. For transmit path COBBA perform analog to digital conversion of the ‘Transmit Amplifier Power Control Ramp’ and the In-phase and Quadrate signals. A slow speed digital to analog converter will provide automatic frequency control (AFC). COBBA is at any time connected to CPU (ASIC) with two interfaces, one for transferring Tx and Rx data between CPU and COBBA and one for transferring codec Rx/Tx samples.

The audio control and processing are taken care by the COBBA-IC, which contains the audio codec and CPU. CPU contains MCU and DSP blocks, handling and processing the audio signals. The inputs can be taken from an internal microphone, a headset microphone or a hand free unit. The microphone signals from different sources are connected to separate inputs at the COBBA ASIC. Input for the microphone signals are differential type. Input and output selection and gain control is performed inside the COBBA ASIC according to control messages the CPU. DTMF and other audio tones are generated and encoded by the CPU and transmitted to COBBA IC for decoding.

Audio Block Diagram

(28)

Scientech Technologies Pvt. Ltd. 28 COBBA IC and CPU Communicate through a PCM Serial Interface. The interface consists of following signal: a PCM codec master clock (PCMDCLK), a frame synchronization signal to DSP (PCMSCLK), a codec transmit data line (PCMTX) and a codec receiver data line (PCMRX). The COBBA-IC generates the PCMDCLK clock, which is supplied to DSP. The COBBA-IC also generates the PCMSCLK signal to DSP by dividing the PCMDCLK. The PCMDCLK frequency is 1.000 MHz and is generated by dividing the RFICIK 13 MHz by 13. The COBBA-IC further divides the PCMDCLK by 125 to get a PCMSCLK signal 8.2 KHz.

AFC Function :

AFC is used to lock the transceiver frequency to the frequency of the base station. AFC voltage is generated in COBBA with 11 bit DA converter. There is a RC-filter in AFC control line to reduce the noise from the converter. They are AFC tracks base station frequency continuously, so transceiver has got a stable frequency.

Note : Before performing the observation, fully charged the battery and keep the charging ‘On’.

(29)

Experiment 7 Objective: Study of Audio Signal

Procedure:

1. Connect the probe of CRO to (8).

2. Make a Call to the trainer or from the trainer.

3. Ask the person on the line to speak and observe the audio frequency changes.

Figure below show the charges being observed.

Figure (a)

Figure (b) Figure 10

(30)

SIM Card :

Objective : Study of the working of a SIM card in a GSM handset Theory :

SIM is short for Subscriber Identity Module. There are two different sizes used for GSM phones, one is the same size as a credit card and the other is about the size of a stamp. The two SIM card sizes are standardized and are the same all over the GSM world. The advantage of the small card is that it makes it possible for the manufacturer to build even smaller phones. The SIM card is the part of the phone that contains the real phone. Its on the SIM card that all personal facts are kept. The phone itself has no phone number its kept on the SIM card. In other words, you can borrow almost any other GSM phone and insert your own SIM card and make calls as usual. There are many functions on the SIM cards like, for example, memory space for names and phone numbers and SMSs (short text messages). You can activate many different services on the SIM cards.

The development of SIM cards is as fast as everything else in the mobile phone business. The SIM cards are becoming more and more sophisticated and more and more functions are being added and improved. It contains some parameter of the user such as IMSI (International Mobile Subscriber Identity). The SIM is also a database – it stores network state information such as their current location areas identify (LAI). If the handset is turned off and back on again it will take data of the SIM and search for the LAI it was in. This saves time by avoiding having to search the whole list of frequencies that it normally would. The BSI line is connected to SIM card DETX line of CPU. When the power is switched ON with SIM inserted the BSI terminal is grounded by a resistor, all interface line raises to VSIM, DATA A, SIM RST, SIMCLK. The battery identification line is used also for battery removal detection. The SIM card is Powered Down before the power is lost.

Description of SIM card circuit :

SIM card circuit is made mainly by Central Processing Unit (CPU) D300, Power IC N201, SIM card socket and V203. As shown in figure Among these, power IC N201 makes function as interface between Central Processing Unit D300 and SIM card socket. Power IC N201 gets all necessary SIM information from CPU D300. SIM Clock (SIM CLK) is obtained from pin no. A12 of CPU, which is given to pin no.D8 of power IC N201.

SIM reset signal (SIM RST) is obtained from pin no. B11 of CPU which is given to pin E7 of power IC N201. SIM I/O is made out from pin A11 of CPU and given to pin F6 of power IC N201. SIM card detector signal is made out from pin K13 of CPU and given to pin B3 of power IC N201. SIM PWR signal obtained from pin D12 of CPU is made out and given to pin G6 of IC N201. After processing in IC N201 SIM CLK (25), SIM RST, (24), 3V-SIM, (23), SIM DATA is obtained at SIM Socket from this IC. For detecting that SIM card is of 3V or 5V this complete function is completed within one second of turning ‘On’ power. In this way actual measuring of SIM card is also completed immediately after turning ‘On’ power.

(31)

Block Diagram of SIM CARD Circuit

Figure 11 In this way, SIM Card Socket reads the information of SIM Card. After that this information is given again to CPU through IC N201 for next processing and then after this is sent to base station for registering. V203 is protector. Four diodes are connected to it.

SIM Connector Electrical Specification

Note: Before performing the observation, fully charged the battery and keep the charging On.

(32)

Objective : Study of the SIMCARD Detection (without SIM CARD) Procedure :

Step 1 : Switch ‘On’ the trainer without SIM CARD.

Step 2 : Keep a watch on the LEDs CLK, VSIM, connected at the SIM card terminal and connect the probe of the CRO to (25)

Step 3 : The two LEDs will glow voltage will rise measured at (23), (24), (25). Sudden SIM card CLK rise & fall is observed. Since SIM card is not present it falls it happens in less than 1 second.

(33)

Experiment 10 Objective: SIM Detected

Procedure :

Step 1 : Insert the SIM card Step 2 : Switch ‘On’ the Trainer

Step 3 : Observe the LEDs all two LEDs will glow RST, VSIM stays ON. Since SIM card need power continuously & CLK goes with in 6-8 sec approximately, after switching on the trainer that’s after registering to the network. A rise can be observed when there is a Tx/Rx of call or some function is accessed the clock of 3.2MHz (approximately).

Sample Observation Table :

Pin Name Measured parameter No.

1 SIM Supply Voltage 23

2 SIM RST Voltage 24

3 SIM CLK Frequency 25

4 SIM Supply Voltage 27

5 SIM Data Voltage 28

Observation Table :

Pin Name Measured parameter No.

1 2 3 4 5

(34)

Insert the SIM Card and Switch ‘On’ the Trainer

Objective : Study and Measure the CLK of the SIM CARD Procedure :

1. Switch ‘On’ the trainer with SIM

2. Connect the probe of the CRO to (25).

3. Observe the 3 MHz CLK.

Fault Insertion :

Make the Pin 4 of switched fault (1) to ‘Off’. “Insert SIM Card” appears on the screen Note : After fault insertion wait for 4 -5second. Again observe the CLK, it will not be there. Working principle :

Since CLK is must for the card & the disconnection will break the path. So the result is failure to detect the SIM.

Note : All the 6 terminals of the SIM card holds importance if any of the contact is absent then card will not be accepted and shows “INSERT SIM CARD”. Usually this occur when the SIM socket is bent/soiled or in loose contact with PCB or breakage of path from the CCONT IC and also CPU else dry soldering of the IC.

(35)

Experiment 12

Objective : Study of the SIM CARD detection (with SIM CARD) Procedure :

Switch ‘On’ the trainer with SIM. Fault Insertion :

Make the Pin 2 of switched fault 1 to ‘Off’. “Insert SIM CARD” appears on the screen. Working principle :

We already know that the SIM CARD is detected through loop formatted by the “Status” pin of the battery, the disconnection of which fails the detection of SIM card. Note : After fault insertion wait for 4-5 sec or press clear button ‘C’ on the keypad.

(36)

Charging :

Objective : Study and Measure the charging phenomena in GSM handset Theory :

Charging is allowed in any operating state ‘On/Off’. The battery voltage, temperature, size and current are measured by the CCONT (i.e. power supply IC) controlled by the EM-software (Energy Management) running in the CPU. The Energy-Management controls the charging current delivered from the charger to the battery. Charging is controlled by a PWM input signal, generated by the CCONT. The PWM (Pulse Width Modulation) is controlled by the CPU and sent to the CCONT through a serial data bus. The battery voltage rise is limited by turning the Charging switch ‘Off’ when the battery voltage has reached. Charging current is monitored by measuring the voltage drop across a 22 Ohm resistor. DC (charger) connector is physically integrated

Block Diagram of Charging Circuit

Figure 12 An internal 1.5A Fuse in serial with CHRGR+ protects the phone against hazardous Charge current faults e.g. caused by ‘Pirates’ or defective chargers. When Mobile is connected with charger then voltage is given to input pins A2 to A5 of charge control IC N200 through Fuse, F200 and filter coil L202 Varistor. In this condition charge voltage is given to pin no. A3 of power IC N201 through voltage divider circuit made by resistance R 209 (47K) and R210 (4K7). In this way central processing unit gets information of connecting charge power with mobile. According to Control of CPU "PWM Charge Control Signal" is made out from pin no.B5 of Power IC N201, PWM rate is 1 Hz which is given to Input pin F2 of charge controlled N200 For controlling operation of charger ‘On/Off’ made internally in N200. In this way when PWM signal

(37)

is at high level then charger switch turns "ON" and charge voltage (CHRGR +) given to pin A2 to A5 of charge Module N200 is made out from pin.F5 C6, D6 of N200 and internal switch is sent for charging main battery through coil L201 and L513.

When PWM signal is at Low Level then charge signal’s is made cut-off and charging of battery stops. In this condition of complete charging resistance R204 (OR22) makes function as charge detective resistance. Sampling voltage detected by it is given to Input pin B 1 of power IC N201. This information is also sent to CPU 300, then it takes decision that value of voltage of battery is full or not. In this condition CPU sends charge control signal (CHRG-CTRL) to pin C6, D6 of N200 through V205 for controlling charging operation and checking voltage level of battery. If charging is completed then Central Processing Unit sends Control information to power Module N201 for stopping PWM charge control pulse. After that charge switch made in N200 is made cut off and charging of battery stops. When charger voltage becomes high then it is detected from Pin F4 of charging IC and is given to Pin G10 of CPU after making of its comparison its Controls the charging IC through V205. Start-up Charging :

Block Diagram of Charging Circuit

Figure 13 When a charger is connected, the Charging is supplying a startup current minimum of 130mA to the phone. The startup current provides initial charging to a phone with an empty battery. Startup circuit charges the battery until the battery voltage level reaches 3.0V (+/-0.1V) and the CCONT releases the PURX reset signal and program execution starts. Charging mode is changed from startup charging to PWM charging that is controlled by the CPU software. If the battery voltage reaches 3.55V (3.75V maximum) before the program has taken control over the charging, the startup current is switched ‘Off’. The startup current is switched on again when the battery voltage has dropped 100mV (nominal).

(38)

Scientech Technologies Pvt. Ltd. 38 The purpose of the capacitor on the CTIM pin is to reduce Output Current slew-rate of the Charging. This is to minimize switching noise in the Audio circuits. The CTIM-pin is also controlled by the CPU-signal CCUT. When CTIM is shorted (CCUT=’1’), the Charging stops charging. During detection of accessories the charging is stopped to prevent, that ‘high’ charge current will disturb the sensible A/D-measurement. Charging block diagram is shown in figure overleaf. The Charging includes an over-voltage protection circuit (input pin VBAT), which purpose is to protect the phone from damage caused by too high Battery voltage. The VBAT input voltage is

connected through a 120R and 1µf capacitor acts as a filter to reduce influence of over

voltage transients caused when connecting the charger. Different cutoff voltages (VLIM1 or VLIM2) for two different battery types (Li or Ni) are selected by the CPU via Charging-input pin LIM.

The newer battery types from the battery vendors are getting ‘better and better’, which means that the charge voltage of a fully charged battery now is higher than when the VLIM threshold was specified. This means that the difference between VLIM and the actually battery voltage is decreasing and the risk of Over voltage protection occur during a normal charge is likely to occur. A voltage divider (120R+3K3) on the VBAT input of the Charging is implemented to solve this problem. The voltage divider is only active during charging which is controlled by a transistor activated by the CPU signal CHAR_CTRL.

Battery Connector (X203) :

The electrical specifications for the battery connector are shown in Table. It consists of four terminals. 1) Battery +Ve 2) BSI 3) Btemp 4) Ground

Table : Battery Connector Electrical Specification Pin Name Min Max Unit Notes

1 VBATT 3.1 5.2 V Battery voltage

2 BSI 0 2.85 V

Battery size indication

Phone has 150Kohm pull up resistor. SIM Card removal detection

(Threshold is 2.4V@VBB=2.8V)

2,2 51 Kohm "Nickel Battery" Size indication resistor

(Rs)

56 130 Kohm "4.2v Lithium Battery" Size indication

resistor (Rs)

3 BTEMP 0 1.4 V Battery temperature indication

Phone has a 100K (+-5%) pull up resistor,

Battery package has a NTC pull down resistor

47KΩ +-5%@+25C, B=4050+-30%

4 GND 0 0 V Battery Ground is connected directly to

(39)

Pin 1 : Battery Voltage (VBATT) :

This is the supply Pin of the battery; it supplies power to the system and also acts as a charging terminal. The voltage available at this Pin is 3.6V (approximately) with charger connected and no battery load. Measured at (20)

Pin 2 : Battery identification (BSI) :

The battery type/size is indicated by a resistor inside the battery pack. The resistor value corresponds to a specific battery capacity. This capacity value is related to the battery technology as different capacity values are achieved by using different battery technology.

Different battery types are identified by a pull-down resistor inside the battery pack. In the base band area of the transceiver, the BSI line has a 150K pull-up to VBB. The MCU can identify the battery by reading the BSI line DC-voltage level with a CCONT (N201) A/D-converter and this terminal is necessarily to switch ‘On’ the Handset when charger is connected. And no battery load, 2.8V (approximately) is measurable at the terminal (21).

BSI connections for all battery types

Figure 14 The battery identification line is used also for battery removal detection. The BSI line is connected to a SIMCardDetX line of CPU2. SIMCardDetX is a threshold detector. The battery removal detection is used as a trigger to power down the SIM card before the power is lost. The BSI contact in the battery is made 0.7mm small in comparison to the supply contact and therefore it disconnects before the other contacts so that there is a delay between battery removal detection and supply power off.

Pin 3 : Battery temperature (BTEMP) :

The battery temperature is measured with a NTC inside the battery pack. The BTEMP line inside transceiver has a 100k pull-up to VREF. The MCU calculates the battery temperature by reading the BTEMP line DC-voltage level with a CCONT (N201) A/D-converter. This Pin holds importance while battery charging, if disconnected or improper input from this Pin will lead to “Not charging”.

(40)

Scientech Technologies Pvt. Ltd. 40 Standard Battery BTEMP connection

Figure 15 The voltage available at this Pin is 1.5V with charger connected and no battery load. Measured at (22)

Pin 4 : Ground (GND) :

This pin is directly connected to ground.

Block Diagram of Battery Terminal

(41)

Charging experiments

1. We already know that charging voltage is 6V - 9V, we can measure at input (29).

Fault Insertion : Procedure :

• Switch ‘On’ the trainer with or without SIM

• Make the pin (3) of switched fault 2 ‘Off’.

• Switch ‘On’ the charging.

• Nothing Happens/No Indication When Charger Is Connected

Measure the voltage at input (29) it will be 0V and hence no output. Working Principal :

This is usually when any of the components in the input path goes faulty such as fuse, Varistor etc.

2. We already know that output voltage of charging IC is 3.6V. Measured at output

(30), when charging ‘On’ and battery removed Procedure :

Switch ‘On’ the trainer with / without SIM. Fault Insertion :

Make the pin (1) of switched fault 2 ‘Off’. And switch ‘On’ the charging.

• Charging Indication But Battery Doesn’t Get Charged

1. Make charging ‘Off’ 2. Switch ‘Off’ the trainer. 3. Remove battery

4. Now switch ‘On’ charging.

Measure the voltage at output (31) it will be 0V and Measure the voltage at (30) it will be 0V but 6V - 9V will be present at input (29)

Working Principal :

The voltage present at (29) is circuit & IC input and CPU gets the information of charging connection, hence indication but no voltage at (31) that’s the input to the charging IC and hence no output.

These usually happens when the charging IC that a BGA IC is dry soldered or due to dust. This can be eliminated by heating and cleaning of PCB or else charging IC may be faulty.

Note : When the battery is connected the (30) will show the battery voltage 0V -4.5V and to check charging voltage, we have disconnect battery.

(42)

3. We already know that 1.5V is present at battery temperature (22) with charging

‘On’ and battery disconnected. Procedure :

Switch ‘On’ the trainer with /without SIM Fault Insertion :

Make the pin (3) of switched fault 1 ‘Off’. Switch ‘On’ the charging. “Not Charging” Appears on the screen :

1. Switch ‘Off’ the charging 2. Switch ‘Off’ the trainer 3. Remove the battery 4. Switch ‘On’ charging

5. Check voltages at B- temperature (22) it will be 0V. Working Principal :

Since the temperature of battery being regularly verified by the PS IC while charging and if fails to perform it generates an error. “Not Charging” and stop charging.

This happens due to disconnection of path between power supply IC and battery temperature terminal or dry solder or improper data to IC, faulty power supply IC or wrong battery.

It should be checked whether the fault occurs only intermittently or if it is permanently impossible to charge the battery. In case that the fault appears only from time to time, especially check contact springs of connector X200 and battery-connector X203 if bent, soiled or corroded. Also ensure that contact-pads for connectors on PCB are not dirty, if necessary clean them with an appropriate amount of IPA.

(43)

Experiment 14 Power Supply :

Objective : Study and Analyze the CCONT IC in a GSM Handset Theory :

In normal operation, the base band is powered from the phone’s battery. The battery feeds power directly to the CCONT IC, Power Amplifier (PA) and UI (buzzer and LEDs for display/keyboard). Shows a block diagram of the power distribution.

The heart of the power distribution is the CCONT. It includes all the voltage regulators and feeds the power to the whole system. The base band digital parts are powered from the VBB regulator which provides 2.8V base band supply. The base band regulator is active always when the phone is powered on. The VBB base band regulator feeds CPU and memories, COBBA digital parts and the LCD driver in the UI section. There is a separate regulator for the SIM card. The regulator is selectable between 3V and 5V and controlled by the SIMPwr line from CPU to CCONT. The COBBA analog parts are powered from a dedicated 2.8V supply VCOBBA. The CCONT also supplies 5V for RF.

Block Diagram of Power Distributor

Figure 17 CCONT includes also five additional 2.8V regulators providing power to the HAGAR, Local Oscillator, Crystal sections. These regulators are controlled by SW via the serial Bus GENSIO (1:0) from the CPU. CCONT generates also a 1.5 V reference voltage VREF to COBBA/ HAGAR. The VREF voltage is also used as a reference to some of the CCONT A/D converters. A supply of 2V (Vcore) is supplied for the CPU.

(44)

Scientech Technologies Pvt. Ltd. 44 The Power ‘On/Off’ key is connected to the PWRONX / WDDISX pin of the CCONT IC. The (RTC) Real Time Clock function is also integrated in the CCONT IC. The CCONT IC acts as mediator between SIM & CPU. Battery charging is controlled by a PWM signal from the CCONT IC.

The watchdog block inside CCONT contains a watchdog counter and some additional logic, which are used for controlling the power on and power ‘Off’ procedures of CCONT. Watchdog output is disabled when WDDisX pin is tied low, the WD- Counter runs during that time, though. Watchdog counter is reset internally to 32 sec. at power up.

(45)

Experiment 15

Objective: Study and Measure the supplies generated by CCONT IC Procedure:

1. Switch ‘On’ the Trainer with SIM inserted.

10 – 1.5 V 11 – 5 V 12 – 2.8 V 13 – 2.8 V 14 – 2.8 V 15 – 2 V 16 – 2.8 V 17 – 2.8 V 18 – 2.8 V 19 – 2.8 V

Real Clock Time Real Time Clock :

Requirements for a Real Time Clock (RTC) implementation are a basic clock (hours and minutes), a calendar and a timer with alarm and power ‘On/Off’- function and miscellaneous calls. The RTC will contain only the time base and the alarm timer but all other functions (e.g. calendar) are implemented with the MCU software.

The RTC is integrated in the CCONT, because the CCONT already contains the power up/ down functions and a 32 KHz sleep-clock, which is always running when the phone battery connected. The 32 KHz sleep-clock is used as time source to a RTC block.

(46)

Objective: Study of the RTC Procedure:

1. Switch ‘On’ the trainer

2. Connect CRO to (9)

3. Observe the clock.

4. Keep the probe connected and switch ‘Off’ the trainer

5. Observe the clock (Clock signal can be measured on a frequency counter

32.76 KHz)

6. Remove the battery and the signal is lost.

Working Principal :

Since the 32 KHz signal of the oscillator is used or time source of RTC. The signal is generated by the oscillator as long as battery is connected and time will be running. Once the battery is removed the time data will be lost and the trainer (mobile phone) asks to re-enter the time as soon as switch ‘On’.

For the reason some of the mobile phone brands has a rechargeable lithium Ion coin cell on the PCB itself.

Power Up and Power Down The phone is powered up by:

A. Connecting a charger to the phone. The CCONT recognizes the charge from the CHAR voltage and starts the power up procedure.

(47)

Experiment 17

Objective : Analyze the trainer (mobile phone) is partially ON when charger is connected.

Procedure :

1. Connect the battery.

2. Don’t switch ‘On’ the trainer.

3. Switch ‘On’ the charging.

4. Observe the charging indication on the LCD.

5. Base band voltage 2.8V at (18) can be measured using a DMM.

A RTC interrupt. If the real time clock is set to alarm and the phone is switched ‘Off’, the RTC generates an interrupt signal. Which will power up the phone at the alarm set time (internal CCONT signal RTC PWR set to logic 1). The RTC interrupt signal is connected to the PURX line to give a power on signal to the CCONT just like the power key.

(48)

Objective: Analyze that a mobile phone is powered ON at the alarm Set Time Procedure :

1. Switch ‘On’ the trainer with SIM.

2. Press “Menu” button.

3. Use scroll keys to until you get the option ‘Clock’.

4. Press ‘Select’.

5. You will get option ‘Alarm Clock’.

6. Press the ‘Select’.

7. If you have not set the time. It will ask to enter the current time.

8. It asks for date which can escaped.

9. Then “Set Alarm Time for 2 or 3 minutes duration from the current time.

10. You should get a bell symbol in the display.

11. Switch ‘Off’ the trainer (Don’t remove the battery). 12. Now, wait for the current time to reach the alarm set time.

13. On reaching the alarm set time, you will observe the trainer’s geting ‘On’. And you will hear the alarm ringing.

Power up with power switch (PWRONX) :

When the power on switch is pressed the PWRONX signal will go low means grounded. CCONT will switch ‘On’ the CCONT digital section and VCTCXO, as was the case with the charge driven power up. If PWRONX is low when the 62 ms delay expires, PURX is release and SLEEP control goes to CPU. If PWRONX is not low when 62 ms expires, PURX will not be release, and CCONT will go to power ‘Off’ (digital section will sent power ‘Off’ signal to analog parts. Else the PURX is released). The CPU releases the system reset and start the execution. In normal operation, the execution continues from flash program memory. However if the MBUS line is pulled low during the power up the boot ROM starts a flash programming sequence and wait for prommer response through FBUS RX line.

(49)

Experiment 19

Objective: Analyze power ‘On/Off’ (PWRONX) signal is triggered with low/grounded

Procedure:

1. Connect the battery to the trainer.

2. Take the short link provided

3. Short the PWR point to ground for a second or two.

4. Observe that trainer is switched ON.

Working Principal : Since the mobile phone is triggered when grounded and power up procedure will start.

Power Down :

The phone is powered down by :

• While PWRONX / WDDISX signal to low/Ground. (The power key to hold for

a more duration)

• Pressing the power key, that is monitored by the CPU, which starts the power

down procedure.

• If the battery voltage is dropped below the operation limit, either by not

charging it or by removing the battery.

The power down is controlled by the CPU. When the power key has been pressed long enough, or the battery voltage is dropped below the limit, the CPU initiates a power down procedure and disconnects the SIM power. Then the CPU outputs a system-reset signal and reset the DSP. If there is no charge connected the MCU writes a short delay to CCONT watchdog and resets itself. After the set delay the CCONT watchdog expires, which activates the PURX and all regulators are switched ‘Off’ and the phone is powered down by the CCONT.

(50)

Objective : Study the power ‘Off’ triggered by low signal (ground) Procedure :

1. Switch ‘On’ trainer

2. Take the short link.

3. Short the PWR point (Blue color) to Ground point (Black color) hold for 3-4

seconds.

4. Observe the trainer getting ‘Off’.

Modes of Operation A. Acting Dead :

If the phone is ‘Off’ or switched ‘Off’ and when the charger is connected, the phone is powered on enters a state called “acting dead”. To the user, the phone acts as if was switched ‘Off’. A battery-charging alert is given and a battery charging indication on the display is shown to acknowledge the user that the battery is being charged.

(51)

Experiment 21 Objective : Analyze the acting dead mode

Procedure :

1. Connect the battery

2. Switch ‘On’ the trainer, observe the indication on the display.

3. Voltage can be measured from (10)- (14) in accordance with chart provided.

B. Active Mode :

In the active mode the phone is in normal operation, scanning for channels, listening to a base station, transmitting and processing information. All the CCONT regulators are operating. There are several sub-states in the active mode depending on the phone is in burst reception, burst transmission, if DSP is working etc.

C. Sleep Mode :

In the sleep mode all the regulators are off sleep mode is activated by the CPU after CPU and DSP clocks have been switched ‘Off’. The voltage regulators for the RF section are switched ‘Off’ and the VCTCXO power control. VCTCXOPwr is set low. In this state, only the 32 KHz sleep clock oscillator in CCONT is running. The flash memory power down during input is connected to the ExSysResetX signal, and the flash is deep powered down during the sleep mode.

(52)

Objective : Analyze the Sleep mode Procedure :

1. Switch ‘On’ the trainer with/without SIM.

2. Now switch ‘Off’ after 2-3 seconds. (Don’t disconnect the battery)

3. Voltages from (10) to (19) will be 0V except the 32 KHz at (9) which can be

observed with the help of a CRO or a voltage of 2V (approximately) can be observed.

User Interface Section LED :

LED: Light Emitting Diode, helps the user while performing function. The LED in mobile phone is of SMD type instead of traditional LED’s due to much compactness required and many mobile specifications. The LED circuit consists of CPU, UI IC and LED. The DC signal is made out from pin C12 of CPU whenever handset is switched ‘On/Off’, Tx/Rx even a key is pressed depending on the menu features. The signal obtained from the CPU is given to Pin 7 & 15 of UI IC.

Block Diagram of LED

Figure 18 The UI IC gives output for keypad/Display LED separately but simultaneously. The LED’s are connected in parallel. The anode of the LED’s is connected to VBAT. Varistors are connected for protection in addition resistors are connected for both (LED & Keypad) LED’s for intensity control. The time duration for the LED is software controlled often menu driven.

(53)

Experiment 23

Objective: Verify and Analyze the intensity is Hardware control Procedure:

1. Power ON the mobile Trainer

2. Vary the potentiometer to clock/anticlockwise