TSP

In this episode Shahriar presents an in-depth analysis of the an Anritsu single-port USB VNA which operates from 150kHz - 6GHz. The instrument has a corrupted firmware which prevents it from being useable.
The instrument's internal dual-board design is presented alongside detailed analysis of the digital and RF boards. Various components are identified as well as the ferrite directional coupler at the heart of the RF path. A simple version of such a coupler is used to demonstrate the impact of the ferrite material on the low-frequency coupling factor.
www.TheSignalPath.com
/ thesignalpath​​​
www.Patreon.com/TheSignalPath

[@Thesignalpath]

*Minor Correction: If you look closely on the right side of the coax, you can see a resistor mounted on its side. At first I thought that they were using the coax as a balun as well as the coupler for the reflected wave. But in reality it is only used as a wideband differential converter. The coupler for the VNA function is made of a resistive Wheatstone bridge. I have covered Wheatstone bridges in one of my previous videos. This bridge needs a differential signal which is exactly what the coax coupler does all the way down to low frequencies as I demonstrated. Thanks for a viewer who pointed this out!*

[@adrianwolmarans]

I must admit that I was a bit puzzled by the description of this reflectometer, and then when I read your comment here I kicked myself that I hadn't realized that it was a Wheatstone bridge. Still, after that it took me a while and a few pencil sketches to work out how it's connected up. It's pretty twisty! After you neat demo of the ferrite choke on the balun, wouldn't it be worth briefly diving into how this bridge is connected. There is a bit of RF finesse here to, since I think that the cap in series with the vertical resistor might be also used to compensate for the stray inductance of the coax screen. It's would also be interesting to know why the resistor is mounted vertically, i.e. if is to minimize stray shunt capacitance, then how would the effect of this stray manifest?

[@qpn6ph9q]

What an awesome demonstration of quite a complex principle. It's kind of good in a way that you accidentally got the wrong network analyzer.

[@pingu11]

You have the reflected and coupled incident signal paths reversed. The incident signal is coupled to the mixer via the 2 resistor splitter just before the entering the coax balun.

[@Thesignalpath]

Please see the pinned comment.

[@LutzSchafer]

Shahriar we used these coax baluns for antenna dipole transforming symmetric 240 ohms to a 60 ohm coax. The important thing was that the coax had to be a quarter of the wavelength. In your case there's a huge bandwidth to be covered which raises the question of how good the symmetry and how stable the impedance over the entire range is. However you show that for the range up to 1GHz it seems very good with little insertion loss.

[@JonPMeyer]

Awesome demonstration of a concept that some of us find non-intuitive. Thank you!

[@electronics.unmessed]

Wow, really interesting to see the decent RF design inside. Thanks!

[@JohnChuprun]

Than you. I pause and rewinds so much on your videos.. always learning so much :)

[@loueckert4970]

Great video tutorial, especially on the coupler. Learned alot.

[@aljazblatnik]

I think that the RF path of the forward and reflected wave is the other way around. The LO output is followed by a power divider and then a balun-based directional coupler. The reflected wave goes into the first mixer from the right.

[@ThatEngineerGuy_]

Cheers to the best professor that I never got. You’re brilliant bud been watching you for a long time. Another great video thank you.

[@AI7KTD]

I really enjoyed this video, I'm glad you bought the one with the bad firmware

[@shinongmao1915]

Thanks for teardown and the explainations. I used this VNA to do most of my grad study experiments, it is fast and accurate. I did not take it apart because I fear I could not get my degree if I damaged the device. I am so excited to see what looks inside.Thank you

[@changpuak]

Don't worry. Even our Prof's do reverse Engineering. And some fail in the Re-Assembly :-)

[@ekoorangil1880]

Coax shield is much thicker than skin depth! The inside of the shield is already 1:1 (tightly) coupled with the center conductor. The ferrite increases the inductance on the outside of the shield, effectively preventing a short circuit at low frequencies.

[@robertwatsonbath]

Thanks Shahriar. Interesting choice for the synthesizer PLL/VCO. Looks to be an ST STW81200, made in a 0.25um SiGe process. I was expecting to see more common TI LMX or ADI ADF parts. Not picked through datasheet yet to see perhaps why.

[@kfitch42]

I assume you have already checked the simple things: short from power to ground or a break in the data lines coming from the usb connector. Chances are J4 is a JTAG connector from which you could directly dump/program the flash chip you think is corrupted. If that doesn't work you could desolder the chip and use an external programmer. Knowing what to program might be tricky. You could download the related software and dig around for a file of about the right size. Of course if might have some header/trailer that needs to be stripped first. That being said it is also possible the image for the flash chip is baked into some larger file or executable, in that case this may become a larger reverse engineering challenge.

[@proweb7271]

Very nice vidéo, thanks !!!

[@savas134]

Great content 👏

[@anastasiosthomaidis207]

A very informative video, thanks Shahriar! Anritsu makes quality products, and everything is OK for as long as they work. But if something fails, you're essentially on your own. No schematics or real service manuals are to be found anywhere. They don't even answer inquiries on their website about fixing the instruments themselves! I learned that the hard way, after my S251A failed. I guess they don't care enough for their customers to provide support for an older instrument.Such a shame...

[@jacobschopp798]

cool topic!

[@emingroup2011]

Very nice video!

[@InssiAjaton]

I would have hoped to see differences in ferrite types. The last type I started favoring in my noise abatement needs happened to be Fair-Rite 31, and somebody else had earlier picked type 73. I believe that latter one was due to off the shelf availability and probably also price consideration of our vendors. Anyway, there is a third material from Fair-Rite, type 61, which I have never tried, just seen in the catalogs. Also, there appear to be comparable ferrite materials available from several manufacturers, such as Magnetics Inc, which uses letter designators rather than numbers. If I have understood, not all materials are available as a clamp-on parts, though. I would guess that the shown clamp was equivalent to the type 73?

[@websterleone]

Well, if it is the firmware, you could buy the other one with the fault and see about ripping the firmware off the EEPROM and programming it onto this one. May also be worth trying pulling it off this one to see if it *is* the EEPROM or not. Could also hook up a logic analyzer to see if it's even attempting to read the chip.

[@TheOnlyPsycho]

Or, what about renting one that works for sure and copying it from there, of course that would mean he would be breaking a CAL seal on the case, but I remember seeing a video on someone I have subbed to that removes those holographic seals with some solvent without damaging them and re-sticking them.

[@neonkev7866]

Nice analysis. This reminds me of Copper Mountain Technologies, who also make 1 and 2 port USB VNAs (edit: they make multiport VNAs too. Up to 16 ports in one test set!) . I would like to see what the inside of their boxes look like. They advertise some pretty exceptional RF specs.

[@donteto]

The dynamic range should be pretty tough to achieve, specially if the solution is a one board, multiport vna.

[@ernestb.2377]

You should start a full RF course 🙂

[@akosbuzogany2752]

Hi Shahriar! How the cutout influences the system? As of my understanding it should behave as a filter repeating over harmonics, however the S-Parameters seems pretty flat.

[@mikes8096]

Mine MS46121B died the same way. Before that was sometime an error of temp reading and lock error U. I unplug USB cable and after that both LEDs are on. So the device looks like in permanent reboot or something wrong with analog parts.

[@paulpaulzadeh6172]

Hi shahriari, Could you make one project from scratch to show how you able to do that with simple tools . Maybe one phase array radar , it would be very nice for us.

[@1010tesla]

Where can I buy that pointer you use?

[@dtiydr]

2:34 I actually doubt it since its not necessary here, the marking from a CNC could be from the mold.

[@user-nu6rt5hq1v]

Hi Do you have an idea why some devices below 1MHz have an "IF Lock Error"?

[@arashghasemi]

Hi Shahriar, in 15:01 those tiny hole array around traces and components have different diameters and spacing patterns. How do they compute those diameters and patterns? My gut feeling is that those will breakdown incoming reflected waves into higher frequency waves with smaller amplitudes so they are not absorbed in 0-6ghz range?? Is this interpretation right?

[@donteto]

I think it's because of the CAD and it's DRC rules. You use the smaller vias to build an electric wall around your RF. The distance between vias is so small that the wavelength of the 6GHz signals are way bigger than the distance between them. Did I understand your question?

[@KD0CAC]

An idea to check my thinking ? In the Anritsu device the ferrite is 2 pieces , to my understanding that is like 2 passes through giving more choking ? Thanks again

[@galileo_rs]

yes

[@sverreh]

The firmware for the fpga seems to be in the firmware folder when you install the shockline vna software, should be doable to program the rbf file over jtag or flash a new spi chip with it...

[@Thesignalpath]

Would be worth trying!

[@sverreh]

@@Thesignalpath Might be interesting to scope the signals on the header asumed to be jtag at power up (or direclty on eeprom), see byte blaster II pinout, the conf_done signal is interesting, interesting to see if it manages to load the firmware or not to see if it is corrupt eeprom or something else.

[@SansNeural]

Heh, YT deletes my comments when I tried to say this. Guess I have to choose my words carefully.

[@thefinalmovements80]

Hello sir my name is Hari, i am from india i get a lot of help from your videos with the help of your videos i repair many electronics items. Sir, I request you to tell about the procedure for repairing electronics instruments, tell about the basic information of the electronic components , as well as tell about which type faults can come in electronic instruments and how to repair them, please explain. I can say with guarantee that if you have made video about electronics repair procedure then you will have lot of subscriber from India.

[@s3sebastian]

Have you already checked if not just the micro USB socket is broken? Because you just mentioned a potentially corrupted firmware. Always when I see a device with a micro USB port that won't communicate I assume that this is the fault, these things break so easily.

[@Thesignalpath]

The unit does get detected correctly by the computer. But the software just hangs and never fully loads.

[@EEEAmin]

Please make something with x microwave component

[@R2AUK]

❤ 👍

[@steubens7]

installed the shockline software to poke around at firmware updates and the bitfiles are just sitting there? Program Files (x86)/Anritsu Company/ShockLine/Application/Firmware/MS46121A/ USBVNA.rbf & USBVNA.rbf2 since it's an ftdi part it likely doubles as a programmer, it might even be what's in a usb blaster

[@steubens7]

the standalone CapVNA program just sends SCPI commands, if it's not utterly dead you can probably upload the firmware that way too

[@steubens7]

an entry on the system menu on the shockline software lets you program a firmware and will even open a dialog to select an rbf file

[@Thesignalpath]

The software never loads at all. It just hangs. I’ll try the CapVNA.

[@mikes8096]

@@Thesignalpath Hi! have you tried? Any success? Thanks for answering

[@mikes8096]

@@Thesignalpath hi ) any news? )

[@mustafam9550]

Sir, is there a watch list belong to you that you suggest to realy learn Electronics? İ have Just graduate Electric Electronic engineering but we didnt saw this informations in the university

[@pete3897]

www.youtube.com/@Thesignalpath www.youtube.com/@EEVBlog www.youtube.com/@MikesElectricStuff You're welcome :)

[@jb5631]

Electronics is a very wide field. If you want to learn more about RF; aside from his videos I recommend you take some specific courses for it.

[@karlbesser1696]

Is it currently possible to buy a high quality 2 port USB VNA in the 6 GHz range under $500?

[@galileo_rs]

There is LiteVNA that goes to 6GHz, but is not that great above 3GHz for about $150 and LibreVNA for about $600.

[@karlbesser1696]

@@galileo_rs Thank you Dragan. I'll have a look and see where I can order it.

[@user-xlario]

@@karlbesser1696 I have the LibreVNA and works pretty well.

[@karlbesser1696]

@@user-xlario Thanks, good to know.

[@AlexTaradov]

The case looks die cast. Machining marks are from the mold.

[@Thesignalpath]

I think you may be right.

[@WolfmanDude]

Micro USB on professional hardware? Is that normal now?

[@jb5631]

Unfortunately micro & mini USB are way too common on professional hardware... Personally I wish USB-B will make it's return.

[@TheBackyardChemist]

The casing looks like a die casting that has been milled a bit, this is not how a fully milled metal piece tends to look like.

[@briansauk6837]

It looks like you could use a USB Programmer CH341A to reflash the eeprom. You can get one with a clamp that will allow programming in place. Just a thought.

[@jb5631]

Programming is of course not the issue. As he said; getting the firmware is.

[@PIRATES3D]

@@jb5631 Maybe it's possible to clone the firmware from a working unit.

[@briansauk6837]

@@jb5631 He mentioned that there was no support from the manufacturer to program it; i.e. no j tag or usb based programming documentation.

[@PIRATES3D]

@@briansauk6837 Yes, but u can flash the eprom directly.

[@briansauk6837]

@@PIRATES3D That was my point.

[@zyxwvutsrqponmlkh]

Those "mixers" look suspiciously like a FULL BRIDGE RECTIFIER.

[@Thesignalpath]

Ha!

[@pauldeboer]

Apart from the fact that when you build your rectifier like that all you get is smoke...

[@zyxwvutsrqponmlkh]

@@pauldeboer ABB knows how to put the smoke back in.

[@soothcoder]

Yeah I found Anritsu to be the absolutely least helpful company when it came to getting help on repairing their equipment. They are happy to charge you a hefty sum to do it but help you do it yourself. Nah.

[@andreya7567]

Advantest is the same. They never publish repair or service manuals.