MDO4000 RF “Reverse Engineering”

After Dave’s Tektronix MDO 4000 teardown I decided to try to reverse-engineer its spectrum analyzer PCB. I used Dave’s high resolution photos (from his Flickr), my general RF knowledge and one of Dave’s post comment, by “Carlos” (helpful, thanks!).
My last work consisted of RF maintenance and design, with a large range of frequencies, so the block diagram I made shouldn’t be too off from the reality.
MDO4000 RF section

I think I got the most of the PCB. A lot of parts are from Hittite (RF switches, amps, VCOs and Log detector). I omitted some minor parts (DC and AC blocking for example). Unfortunately, I wasn’t able to find the I/Q analog-to-digital converter. Maybe it’s under one of the shielded cans or on an other PCB. As it’s a 10GSpS, it must have direct access to a memory of any sort, so it could be close to the main processor/FPGA.

Schematics (pdf):

MDO4000 RF Block Diagram

Photo with the numbers matching the schematics (pdf, 6Mb):

MDO4000 Photo with numbers for the Block Schematics

Block schematics with PCB components thumbnails (pdf, 9Mb):

MDO4000 RF Block Diagram with Thumbnails

If you find any error or want to add comments to the schematics I made, don’t hesitate to comment!!

5 thoughts on “MDO4000 RF “Reverse Engineering”

  1. Beautiful work documenting the spectrum analyzer section! I’m doing some (admittedly lightweight) RF design lately, and will suck as much black magic as possible out of this. Thanks!

    • Thanks!
      Actually, I think a lot of the magic happens in the system that controls the different components and links it with calibration data. Also, the small resistors/caps/coils arrangement and values are very important.
      But you can have quite a lot of info whit Hittite datasheets and app notes.
      I’m still wondering where the main ADC is. The PCB has at least 4 layers with blind vias, so it’s difficult to see where the tracks are going.

  2. The board is the “Analog Frontend” of a {DPO,MSO}4000B/MDO4000/{DPO,MSO}5000-series scope; in this case, it’s one with the RF mixer, but for the other models, there are various flavors depending on the bandwidth of the scope. They all plug into the same three connectors.

    The 4 ICs with the heatsink (in the non-RF path) are HF amplifiers, however I don’t know the interconnection of the RF path to these.

    The main ADCs then are on a seperate board – shows them. U3701 and U6301 are the ADCs (2 channels each), and the chips on the right, connected to the memory, are the “Demuxes”, which store the captured data into memory. They might also contain the DPO/DPX/FastAcq framebuffer, but I’m not sure.

  3. on the RF PCB, bottom side left top corner, there is ADCMP562, i bet TEK is using this comparator as “sampling head”, you can see traces going from this comparator to the region of the FR PCB where the “missing ADC” should be located. A sampling head is good enough here, the data from a specific “frame” is there for some time, so it can be easily sampled with comparator. The amount of data is not that big.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s