Okay, so in the last couple of posts, I focused on making hand-assembly friendly modules, which I'll get back to soon. But in the meantime, I want to put some effort into pinning down all of the requirements for the modules, and for the system as a whole.
We'll take an approach inspired by the "Systems Engineering V Model", which really just means that we'll start at the top, and break it down into sub-systems, and then define their requirements. Then when we have made all the sub-systems, we work from the bottom up, testing and making sure that it all ties together as intended.
To help this all work, one of my key goals is to keep the interfaces between the different sub-modules as simple as possible, so that the integration and testing phase will be as simple as possible. This is supposed to be a simple and modular device, after all! And that's also the whole point of this project: Security is only possible when the system is simple enough to understand and reason about. But let's dive on in...
We are making a "Phone Like Object", so let's sketch out the functionality it will need, and some of the key ingredients that will be needed for that. i.e., let's map out the high-level requirements, in a bit of a hierarchy:
1. Effective power management, so that battery life is acceptable.
1.1 Integrated high capacity battery
For safety and longevity, including in the face of repeated extreme depletion of the battery, we will use a single LiFePO4 cell. Capacity should be sufficient to run for a week or more in idle operation, without any opportunity to recharge.
Assuming about a 30Wh cell, and 168 hours in a week, this means our idle power consumption must be below 30 / 168 = ~175mW, or about 55mA. That feels achievable.
Requirement 1.1.1: Integrated LiFePO4 or other similarly safe and robust chemistry battery cell.
Requirement
1.1.2: Battery capacity and idle power consumption combine to support a
battery endurance of at least 1 week when idle.
Requirement 1.1.2.1: Integrated battery capacity of at least 30Wh.
Requirement 1.1.2.2: Idle power consumption below 175mW.
1.2 Diverse charging of integrated battery
To provide for "energy sovereignty", we need to support a variety of energy sources.
1.2.1 USB-C charging
My biggest concern is that it will take a reasonable amount of effort to design up, and I can't immediately see an off-the-shelf module that has this. Given that I have limited time, I might start out with a simpler module that lacks the UART interface. Like this one from SparkFun, for example, although they are a bit pricey. There are also dirt cheap ones like this, but I don't know if I can trust them.
But the great thing is, that I can just make provision for a USB-C charge and data module, and start with a cheap one first, and then make an updated version when I get time!
Requirement 1.1.2.1: The internal battery shall be chargeable via an integrated USB-C connector, ideally fast charging.
Requirement 1.1.2.2 Define module bay for USB-C charger + data module, large enough
to fit the SparkFun module, as that looks to be the biggest, capable of
delivering 20V @ 3A to the carrier board.
Requirement 1.1.2.3: Proof-of-concept charger module based on a given USB-C power delivery module (no need for data).
Requirement 1.1.2.4: Power isolation mechanism to allow conflict-free operation of the USB-C and alternative power inputs to the MEGAphone (back-flow and over-voltage protection, for example)
1.2.2 Automotive 12V/24V power / external low-voltage solar panel
Cars and other vehicles are effectively portable generators, and by far the most common such resource. Thus we want to accept power from them directly, in case they don't have a USB power output, its busy, or perhaps you just have a car battery laying around.
While the voltage is nominally 12V for car, and 24V for trucks, realistically you can see peak voltages close to double that, and at discharge, perhaps as low as 9V. It can also be noisy as heck.
We can kill two birds with one stone here, by selecting a regulator that can also accept a solar panel, i.e., has a Maximum Power Point Tracker (MPPT), that will do nothing when connected to a battery or car, but will help a lot when charging from an external solar panel.
Requirement 1.2.2.1: Means of accepting (including connector) dirty DC power between ~9V and ~40V using a MPPT to maximise efficiency with a solar panel.
1.2.3 Integrated solar panel
The MEGAphone will include a little integrated solar panel that covers the entire rear of the device (or as much as we can manage to cover). We'll make this using the highest-performance cells we can easily lay our hands on.
I've done previous experiments slicing up the kinds of cells they use on solar race cars and connecting them in series to get sufficient open-circuit voltage at low wattage, and then laminate them using an ordinary paper laminator. But it looks like I didn't blog it anywhere that I can find. It's a pretty rough method, but does largely work, and would allow up to about 4W in full sun, which would allow harvesting enough charge for a week in just a day or so.
But realistically I will probably use some ~1W off-the-shelf little panels to begin with, and the solar cells will be more about stopping the thing going flat when idle, rather than rapidly recharging the battery. But the device should support either, so that we have flexibility.
This means we need a solar regulator that can also handle these sorts of little panels. It might be that we can combine this with the charge regulator for automotive power / external solar panels -- or not.
Requirement 1.2.3.1: Means of accepting DC power from integrated solar panel at input voltages of 2V to 20V with a MPPT.
1.3 Ability to switch each sub-system on and off, even if the main processor is off.
If we want this thing to have any chance of having a low idle power consumption, we need a means of turning on and off each of the major sub-systems, so that they can stop using power when not needed.
Complicating this, we need for the main processor to turn itself off, and then be able to be turned back on... except if it's off, it can't. The solution here is to have a low-power processor or FPGA that all it does is control power to other sub-systems, and watch potential interrupt sources that would require turning on the main processor. For extra power efficiency, it would be great for it to even buffer input from some communications devices, so that the main processor can only be woken up if something important happens, and the communications received in the meantime can be delivered to the main processor after it wakes up.
Think, for example, of the RING message from a cellular modem: We need to turn the processor on in response to that, but there are probably plenty of other unimportant messages that the cellular modem might produce that can be safely ignored. SMS reception is another use-case, here, where we need to make sure that we don't miss the message, but don't want the main processor on all the time just waiting for one to turn up.
Also, we need the communications lines between the various sub-systems to have current-back-flow prevention, so that if a device is powered off, it can't cause current to flow through those data lines causing partial powering of devices (and thus wasting energy), but more than that, back-power can cause all sorts of weird device behaviour.
Requirement 1.3.1: Power management processor that can control power to all other sub-systems, and itself have very low power consumption, ideally <10mW.
Requirement 1.3.2: Ability for power management processor to buffer communications when main processor is powered off.
Requirement 1.3.3: Galvanic isolation of communications lines between sub-systems that can be independently powered off, e.g., using opto-isolators.
Requirement 1.3.4: A small module for galvanic isolation, so that this can be reused.
Requirement 1.3.5: Implement UART connection between power control processor and the main FPGA via MEGA65 buffered UART interface.
Requirement 1.3.6: Protect writing to the power control UART so that it can be done only from the Hypervisor.
Requirement 1.3.7: Implement Hypervisor calls to provide an API for applications to request power to be switched on and off.
Requirement 1.3.8: Implement register access to check battery state and charger status (i.e., charging, discharging, which power source(s) are present).
1.4 High-efficiency high-current switchable DC-DC converters that can handle output voltages either above or below the battery voltage at 2A, with surge currents of 3A. Output voltages of 3.3V and 5V.
Let's explore this one a bit more, as it has some important implications.
"High current" here means "a few Amps", or more to the point, "enough Amps for the FPGA, cellular modem and other large power drawing modules".
Implicit in this, is that I want to use the multiple instances of the same module to power the various sub-systems to create economies of efficiency for parts, but also for assembly steps. For example, if we use the same little module several times over, it becomes much more cost-effective to use an online PCB manufacture and assembly service, by making better use of their minimum ordering quantities (MOQs), that are typically around 5 pieces.
So let's just do a quick tyre kick to work out the maximum current draw of the various larger components:
Looking at the documentation for the EC25 Cellular Modem as an example, Chapter 6.4 of that document lists the current consumption while performing various operations, and Chapter 6.2 has overall peak power consumption listed, with a peak consumption of around 2 A. We'll dig more into this later. Interestingly, the cellular modem might be able to run directly from VBAT, except at lowest battery charge levels. It might be worth exploring that at some point.
For the FPGA, using a Trenz TE0725 as in the past iterations of the MEGAphone, there is no listed maximum power consumption for the 100T variant on Trenz website. However, I know from experience that 2A should be ample. Requires 5V.
Then we have the LCD panel as the next big power draw. More specifically, the backlight, which can consume 40mA at 20V. That voltage will probably require a separate high-voltage regulator, so we can ignore that here.
Otherwise, we may want to connect a Raspberri Pi Compute Module 4. I can't find exact consumption figures, but chatter on the forums suggests that 2A will be fine. It does also need 5V.
Finally, we have any auxiliary communications devices, which we can decide at this point shall also be limited to 2A, so that we can say that our high-current power supply needs are all limited at 2A.
The ISL91127IR looks promising for this.
Requirement 1.4.1: High-efficiency DC switchable DC power supplies that can support various sub-systems with >=2A @ 3.3V or 5V (externally selectable), with an efficiency of at least 90% in typical conditions when powered from a single cell LiFEPO4 battery (28.V - 3.2V).
Requirement 1.4.2: LCD Panel Backlight power supply module (20V, 50mA, powered from VBAT, switchable via a single enable input pin), unless incorporated into the solution to Requirement 3.3.1).
1.5 Low-energy module for components that don't use much power, probably 100mA or less.
This will be required only if the high-current regulators are too inefficient at these low power levels, so that battery life can be maxmised. So we'll only worry about fleshing this out, if it becomes an issue.
2. Communications interfaces
2.1 Bluetooth communications module for hands-free etc
Requirement 2.1.1: Bluetooth host module that can connect to headsets and other audio devices. Must support UART or I2C control, and audio interfaces that we can easily implement from the FPGA, such as I2S audio.
Requirement 2.1.2: Bluetooth host module support for keyboards and other HID peripherals.
2.2 Cellular module for interacting with the mobile phone network.
Requirement 2.2.1: Cellular Module Carrier board that can accept an industry standard industrial cellular modem, breaking out all pins from the connectors, and provides a SIM card slot.
Requirement 2.2.2: Create UART for cellular modem AT command interface to the MEGA65 buffered serial interface. This should keep output from cellular modem in a buffer until the application requests the next line or bunch of bytes, and require acknowledgement each time, to prevent loss of important messages.
Requirement 2.2.3: Allow Hypervisor to protect access to the cellular modem UART.
Requirement 2.2.4: Create Hypervisor API to request access to the cellular modem.
2.3 Alternative communications module interface (for "communications sovereignty").
Requirement 2.3.1: Power-switched, galvanically isolated UART interface to a module bay that can accept an alternative communications module
Requirement 2.3.2: A proof-of-concept module for the above that can accommodate some alternative communications module.
3 Human Interfaces
3.1 One or more microphones
First up, for a phone, we need a way for it to hear the user. Ideally a pair or more, so that we can do some simple acoustic signal processing to subtract out distant sound sources, so that it's easier to use in noisy environments.
From a security perspective it would be good if there was an LED or something that lit when the microphone was powered. Or alternatively the microphone modules could be made easily removable (but not easy to lose?).
Requirement 3.1.1: One or more power-switchable MEMS microphones with power status indication.
3.2 One or more speakers.
We also need a way to make sound, both for a built-in speaker / ear-piece, as well as a 3.5mm headphone/headset jack.
Probably the easiest way to do this is to use a standard "CODEC" chip designed for use with cellular modems. I find their name to be highly misleading, as to me a CODEC is something that does the digital encoding and compression part, like an MP3 CODEC, for example. But I guess it's technically true to call it a CODEC if it is really just converting between analog and digital domains.
Rant aside, these chips are fairly cheap, and are designed to handle all of this mess. I've used one before when I was designing a MEGA65-based phone for people with dementia. Now, the trade-off with those is that they do a lot of black-magic inside, and are a potential risk for exfiltrating audio via RF on speaker or headphone traces etc. I also have a spare TLV32AIC3104 based CODEC module from an EC25 module, so I may yet end up taking advantage of that.
I do like the CUI (now "Same Sky") low-profile speakers that I've used in past prototypes, as well. These tend to be about 40mm diameter, and less than 6mm thick, and are quite loud, typically 1W or more. Those are great for a loud speaker, e.g., for a ringer or speaker-phone or just listening to music or playing games. Something like this.
But those are not the best option for the ear piece, where the chance of it blaring at 1W in your ear is sub-optimal. So it would be good to have a 2nd smaller speaker for when using it as a phone. Or maybe that's overkill, on the basis that we are planning to have a 3.5mm audio jack and Bluetooth output. We can easily re-spin the carrier board to have provision for an extra module for an earpiece speaker, anyway. The modular design strikes again!
Requirement 3.2.1: Audio CODEC or equivalent that has output channels for loud speaker (mono is ok), 3.5mm audio output (stereo) ear piece, and input channel for 3.5mm microphone.
3.3 LCD Panel (including touch interface) for primary display
No big surprises here. We'll stick with the 800x400 or 800x480 ~6 inch LCD panels that I have been using with previous prototypes of the MEGAphone. Again, we can roll-forward on this front, when time allows. These panels use the much simpler to interface with Digital VGA (DVGA), which is basically just parallel digital RGB, sync and a few other signals.
One of the challenges with these panels, is that every vendor and model seem to have the ribbon cable in a slightly different position. So the module to host this needs not only a bunch of pins for all the required signals, with good enough signal integrity for the 27MHz pixel clock, but also that the module needs to be big enough to allow for moving the connector around.
This also feeds into the touch panel interface for these, that vary even more than the DVGA cable positions. Some have a resistive interface on the primary cable, while others have a 2nd cable for the touch panel.
We then also have the backlight power requirement for these panels. For the panels I have here, they require ~20V @ 40mA. So there are plenty of options for this, such as TPS92360. One of these with the required external components could all be loaded onto the panel interface module.
Requirement 3.3.1: Module to connect to industrial LCD panels of the type used in previous MEGAphone prototypes, large enough to allow for some variability in cable lengths and positions, for both DVGA and touch interface. Allow for either resistive or capacitive interfaces. Include appropriate LCD backlight driver and expose the PWM brightness control signal.
Requirement 3.3.2: Module bay to accept the LCD panel module.
3.4 Buttons, switches and knobs for user interaction.
Okay, so now lets look at the switches and things. People who've been following the story of the MEGAphone know that I have a soft spot for thumb-wheels for volume control, including having separate ones for in-call volume, ringer volume and media volume, so that you can easily set those independently, and not have to have the phone yell in your ear, or navigate a menu to make it quiet in a hurry etc.
The travel of the rotating wheel also lets you check the volume settings without having to wake the device up, etc. So something like this. Perhaps paired with an 8-pin I2C I2C ADC like this. That ADC in particular, is interesting in that allows 9 addresses from 2 pins, by sensing high, low and floating.
Then we also need a D-pad type input, and some buttons. As with the previous prototypes, we'll stick with using 3rd-party Game Boy type carbonised rubber buttons.
We also want to be able to have a bunch of LEDs to indicate various things. This includes at least one or two LEDs on the rear side that we can blink, for example, to indicate missed calls/received messages etc.
We also want some slide switches to allow other aspects of the device to be managed, such as hard-disabling some sub-systems, or selecting things like "silent mode".
A little e-paper panel (or two) on the rear would be really good for this, too, potentially with a couple of recessed buttons, too. The advantage of e-paper displays is that they don't consume power except when the display is being updated. That's technically out of scope for the current phase, but I'm highly inclined to add provision for such a module, even if I don't implement support for it in the software, because of just how useful this would be with the rear being a solar panel, thus allowing it to remain "sunny side up" when idle. Something like this I2C e-paper display looks good.
I'm also going to throw in I2C sensors of various other kinds in here. They are not a requirement in this phase, but it will be fairly easy to add provision for them by defining the module interface for them. Then we can easily add accelerometer, digital compass, proximity sensor, thermometer, or whatever you like. Even gas sensors, if you so desire.
Requirement 3.4.1: Module hosting a thumb-wheel potentiometer and an I2C potentiometer, with two pins to select I2C address of the module, and pads on the module to add the selection resistors if required.
Requirement 3.4.2: Module to accept D-pad
Requirement 3.4.3: Module to accept push-button pairs
Requirement 3.4.4: I2C I/O Expander to accept inputs from buttons and control LEDs
Requirement 3.4.5: Slider switch module for input
Desirable 3.4.6: Module for hosting e-ink display and recessed buttons
Desirable 3.4.7: Module specification for hosting I2C sensors and peripherals
4. Computation
For computation, we have one main requirement: An FPGA that can run the MEGAphone's MEGA65 core. But that uses too much power for idle operation, so we also need a low-powered FPGA or microcontroller that can be used to allow that main FPGA to be turned off.
That low-power FPGA should also have the means to buffer communications from the other modules, as well as power everything on and off. It feels like it is also the correct thing to control the e-paper display, so that things like message notification can be performed without having to power the main FPGA on at all. Although that's probably more energy optimisation than we need.
Optionally, I'd also like to have a way to host a Raspberry Pi Compute Module 4 (CM4), so that Android or Linux software can also be used if required, but normally turned off, so that both power and security are optimised.
4.1 Primary FPGA module for running the MEGAphone system
For simplicity, we are just going to mandate the same TE0725 FPGA module that we've used in previous revisions. This does constrain the number of IO pins we have. But it makes it much quicker for us to design.
Requirement 4.1.1: A100T or larger FPGA module SWaP and pin-compatible with the Trenz TE0725.
4.2 Low-power FPGA module for monitoring communications devices while primary FPGA is off to save power.
Here the goal is the lowest idle power consumption possible, while still having enough GPIOs to control the power to everything else. Ideally, this would have enough pins so that we wouldn't need an I2C IO expander or similar running to scan buttons and other inputs.
I'm considering a few options here, including designing my own module around the Trion T4 that 33 IO pins. Alternatively, I might use something like a FireAnt on the basis that then I don't have to design it :) In any case, leaving enough space so that a FireAnt could be used, is probably a sensible approach.
The only thing annoying about the FireAnt is that it requires 3.3V and 5V. But the 5V is only for the USB, which is probably good overall, as the 5V rail can be switched off during normal operation, thus making it harder to accidentally reprogram the FireAnt once it is installed.
Requirement 4.2.1: Module bay that can power and host a FireAnt or similar FPGA module to control the power to all sub-systems, and interdict the communications between the main FPGA and sub-systems that require monitoring when the main FPGA is powerd off.
4.3 Raspberry Pi Compute Module Slave processor
We have spoken about the desire for this. So let's consider what would be required for this. We can either use HDMI from the Pi into the FPGA, or multiplex a digital VGA signal to the LCD panel. Unfortunately, we probably don't have enough pins free on the main FPGA to ingest the digital VGA signal directly.
This is not a major problem for the initial design, but would be an issue for any future version that is oriented around the disability market, where having the MEGA65 being able to read pixels from the Pi's display to do hardware zoom etc.
For now, we are talking just about being able to have a Pi present for running a captive Android instance, so just using some 74LVC multiplexors is probably sufficient.
Desirable 4.3.1: Bay for Pi Compute Module 4
Desirable 4.3.2: DVGA multiplexor to allow LCD panel to display either the MEGA65 or Pi display, on a pixel by pixel basis.
Desirable 4.3.3: Isolatable USB data connection between cellular modem and Pi.
Desirable 4.3.4: UART interface between Pi Compute Module and MEGA65 core.
5. Infrastructure
5.1 Main carrier board(s) to connect the sub-systems together into a robust and easily assembled structure.
This is going to be interesting, and enabled by the castellated module system, as it will allow us to stack 2 and 4 layer PCBs together, without needing lots of fancy 3d-printed parts.
I'm really hoping that this board will be able to be 2-layer, as that will make it much cheaper -- especially if we have multiple of these PCBs that need to stack up to make the whole electronics package. But that stacking does make it more likely that a 2-layer board will be possible, because we can do vias through the boards if required -- even if it will make it a bit of a pain to design. An equivalent approach is to just use external via wires where required, and then have the corresponding holes in the adjacent PCB layer where required to allow space for them -- but even that shouldn't be necessary, since the castellated modules will be sitting between the PCBs and thus create sufficient space themselves.
Requirement 5.1.1: Main carrier board that connects all sub-systems together.
5.2 A case/housing to put it all into.
So then once we have a robust electronics package, we need a way to enclose it all in a sensible and practical case. This can't be done until we know the dimensions of the electronics, of course.
Requirement 5.1.2: Design a 3D-printable / CNC machinable case to contain the electronics package.
6. Software
So let's look at the software side of things now.
6.1 Simple power management API
First of all, we need an API that allows the main FPGA to control which sub-systems get turned on and off. This will be the responsibility of the low-power FPGA module, and will be implemented over a UART interface between the two FPGAs.
Requirement 6.1.1: Power control API on low-power FPGA to allow control of power to all sub-systems, including the main FPGA.
Requirement 6.1.2: Logic to activate power to the main FPGA based on relevant criteria (eg incoming call, user pressing power button etc).
Requirement 6.1.3: UART interface between main and low-power FPGA module exposed via one of the MEGA65 buffered UART interfaces.
Requirement 6.1.4: MEGA65-side software that implements the power control API.
6.2 Simple telephony software
Here the goal is to simply make the system usable in a basic way. So we will just focus on the ability to make and receive calls, and manage a simple contacts list.
Requirement 6.2.1: Can initiate telephone calls via dialing or selecting a contact.
Requirement 6.2.2: Can accept incoming telephone calls, showing contact name when the caller matches an existing contact.
Requirement 6.2.3: Can list contacts.
Requirement 6.2.4: Can add a contact.
Requirement 6.2.5: Can edit a contact.
Requirement 6.2.6: Can delete a contact.
Requirement 6.2.7: Incoming calls are indicated, even if the user is performing some other function (e.g., OSD overlay or blinking LED).
6.3 Simple text messaging software
Similarly for telephone calls, we are focusing just on the most minimal functionality that proves that we can do everything necessary, so that it can be improved upon later.
Requirement 6.3.1: Incoming SMS messages are indicated, even if the user is performing some other function (e.g., OSD overlay or blinking LED).
Requirement 6.3.2: SMS message can be composed and sent to a number or contact.
Requirement 6.3.3: SMS message can be received, and the corresponding contact indicated.
Desirable 6.3.4: SMS messages are logged, so that SMS conversation threads can be displayed.
7 Summary & Diagram
Okay, so that establishes 62 requirements (including 3 desirable properties) for the system. Next I'll look at how these all hang together, so that we can derive any subordinate requirements, in particular, relating the the IO interfaces between the various sub-systems. To get started on that, let's make a block diagram for all of the above.
Hmm... I've been working on it for the last hour or so, and it's not surprisingly getting quite complex. Part of this is that there are several sub-systems that require DC:DC regulators and galvanic isolation for their data paths. So each of those sub-systems requires 3 or more blocks, and eventually, solderable module bays, even if two are repeated for each.
I'm sure that I will have missed some modules and bays in the process, but it will be a good starting point, and as I proceed, I can just add the missing bays and modules as I go along -- yet another advantage of the modular approach.
This also means that my first carrier board will probably be much bigger than I want, until I work out the division into stackable sub-boards. That's also okay, and again, something that is easy to handle as part of this modular approach, as I can just desolder and resolder the modules between revisions of the carrier board. Thus I'll be actively dog-fooding my concept as I develop it. That's a feature, I think.
But first, let's look at that diagram that I've prepared:
It's a bit small here, for the full size version, you can get it from the github repository here.
For convenience, I have also added the collacted requirements list to the github repository.
So, combined with the preliminary work defining the module interface, fabricating and testing sample modules, that finally gets us to the point of being able to sign off on some of the milestones for the NLnet grant that is supporting this work. Specifically the following milestones:
1.1 Power management effective control of all sub-systems: Requirements Specification.
1.2 Power Management interface for use by other software: Requirements Specification.
1.3 Telephony software: Basic Communications With Cellular Modem: Requirements Specification.
2.1.1 High-Efficiency DC-DC converter module to power the various sub-systems: Requirements.
2.2.1 Low-energy power-management module to minimise energy consumption of device, especially in low-power modes: Requirements.
2.3.1 Battery management and energy harvesting module to allow USB-C, integrated solar panel and external 12/24V vehicle battery power sources, and efficient management of the integrated rechargeable battery: Requirements.
2.4.1 Cellular modem communications module, including SIM card module: Requirements Specification.
2.5.1 Internal microphone and speaker module: Requirements Specification.
2.6.1 External speaker and bluethooth headset interface module: Requirements Specification.
2.7.1 Primary FPGA carrier module, leveraging off the shelf FPGA modules if at all possible: Requirement Specification.
2.8.1 LCD panel interface module: Requirement Specification.
2.9.1 Auxiliary communications module, e.g., LoRa, ultra-sonic, infra-red or mm wave: Requirement Specification.
2.10.1 Main carrier board and assembly, into which the various modules connect: Requirement Specification.